By default, Kubernetes pods have unrestricted network access both inside and outside the cluster. However, it is often desirable to restrict network access to and from pods, particularly for security reasons. Kubernetes NetworkPolicies provide a flexible way to implement these networking restrictions, giving you control over all of the network traffic involving your pods. In this lab, walk through NetworkPolicies concepts, and examine some existing policies to determine how we can properly apply them to a pod.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Provide the `web-gateway` Pod with Network Access to the Pods Associated with the `inventory-svc` Service
First, get a list of existing NetworkPolicies:
kubectl get networkpolicyExamine
inventory-policymore closely:kubectl describe networkpolicy inventory-policyNote that the policy selects pods with the label
app: inventory, and provides incoming and outgoing network access to all pods with the labelinventory-access: true.Modify the
web-gatewaypod withkubectl edit pod web-gateway.Add the
inventory-access: "true"label to the pod undermetdadata.labels.... metdadata: labels: inventory-access: "true" ...Test access to the inventory-svc like so:
kubectl exec web-gateway -- curl -m 3 inventory-svc- Provide the `web-gateway` Pod with Network Access to the Pods Associated with the `customer-data-svc` Service
Examine
customer-data-policymore closely:kubectl describe networkpolicy customer-data-policyNote that the policy selects pods with the label
app: customer-data, and provides incoming and outgoing network access to all pods with the labelcustomer-data-access: true.Modify the
web-gatewaypod withkubectl edit pod web-gateway.Add the
customer-data-access: "true"label to the pod undermetadadata.labels:... metdadata: labels: inventory-access: "true" customer-data-access: "true" ...Test access to the customer-data-svc like so:
kubectl exec web-gateway -- curl -m 3 customer-data-svc
