Kubernetes Network Policy

This is the sample network policy rules file for the demo lab. You can watch the full video on YouTube.

note.md

minikube start -p mininet --network-plugin=cni --cni=calico

kubectl create ns net-test
kubectl create ns net-test-1


kubectl run pod-a -n net-test --image=busybox --restart=Never --command -- sleep 36000
kubectl run pod-c -n net-test --image=busybox --restart=Never --command -- sleep 36000
kubectl run pod-b -n net-test --image=nginx --restart=Never

kubectl expose pod pod-b -n net-test --port=80 --target-port=80 --type=ClusterIP
kubectl exec -n net-test pod-a -- wget -qO- http://pod-b.net-test.svc.cluster.local


kubectl run pod-a -n net-test-1 --image=busybox --restart=Never --command -- sleep 36000
kubectl run pod-b -n net-test-1 --image=busybox --restart=Never --command -- sleep 36000
kubectl exec -n net-test-1 pod-a -- wget -qO- http://pod-b.net-test.svc.cluster.local

deny-all.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: net-test
spec:
  podSelector:
    matchLabels:
      run: pod-b
  policyTypes:
  - Ingress

allow-from-pod-a.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-pod-a
  namespace: net-test
spec:
  podSelector:
    matchLabels:
      run: pod-b
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          run: pod-a
    ports:
    - protocol: TCP
      port: 80

allow-name-space.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-namespace
  namespace: net-test
spec:
  podSelector:
    matchLabels:
      run: pod-b
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: net-test-1
    ports:
    - protocol: TCP
      port: 80

allow-from-another-ns-pod.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-other-namespace
  namespace: net-test
spec:
  podSelector:
    matchLabels:
      run: pod-b
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: net-test-1   
          podSelector:
            matchLabels:
              run: pod-a                
      ports:
        - protocol: TCP
          port: 80