Network Policy

If you are running Cilium on Kubernetes, you can benefit from Kubernetes distributing policies for you. In this mode, Kubernetes is responsible for distributing the policies across all nodes and Cilium will automatically apply the policies. Three formats are available to configure network policies natively with Kubernetes:

Cilium supports running multiple of these policy types at the same time. However caution should be applied when using multiple policy types at the same time, as it can be confusing to understand the complete set of allowed traffic across multiple policy types. If close attention is not applied this may lead to unintended policy allow behavior.

NetworkPolicy

For more information, see the official NetworkPolicy documentation.

Known missing features for Kubernetes Network Policy:

FeatureTracking Issue
ipBlock set with a pod IPhttps://github.com/cilium/cilium/issues/9209
SCTPhttps://github.com/cilium/cilium/issues/5719

CiliumNetworkPolicy

The CiliumNetworkPolicy is very similar to the standard NetworkPolicy. The purpose is provide the functionality which is not yet supported in NetworkPolicy. Ideally all of the functionality will be merged into the standard resource format and this CRD will no longer be required.

The raw specification of the resource in Go looks like this:

  1. type CiliumNetworkPolicy struct {
  2. // +deepequal-gen=false
  3. metav1.TypeMeta `json:",inline"`
  4. // +deepequal-gen=false
  5. metav1.ObjectMeta `json:"metadata"`
  6. // Spec is the desired Cilium specific rule specification.
  7. Spec *api.Rule `json:"spec,omitempty"`
  8. // Specs is a list of desired Cilium specific rule specification.
  9. Specs api.Rules `json:"specs,omitempty"`
  10. // Status is the status of the Cilium policy rule
  11. //
  12. // +deepequal-gen=false
  13. // +kubebuilder:validation:Optional
  14. Status CiliumNetworkPolicyStatus `json:"status"`
  15. }

Metadata

Describes the policy. This includes:

  • Name of the policy, unique within a namespace
  • Namespace of where the policy has been injected into
  • Set of labels to identify resource in Kubernetes

Spec

Field which contains a Rule Basics

Specs

Field which contains a list of Rule Basics. This field is useful if multiple rules must be removed or added automatically.

Status

Provides visibility into whether the policy has been successfully applied

Examples

See Layer 3 Examples, Layer 4 Examples and Layer 7 Examples for detailed lists of example policies.

CiliumClusterwideNetworkPolicy

CiliumClusterwideNetworkPolicy is similar to CiliumNetworkPolicy, except (1) policies defined by CiliumClusterwideNetworkPolicy are non-namespaced and cluster-scoped, and (2) it enables the use of Node Selector. Internally the policy is identical to CiliumNetworkPolicy and thus the effects of this policy specification are also same.

The raw specification of the resource in go looks like this:

  1. type CiliumClusterwideNetworkPolicy struct {
  2. // Spec is the desired Cilium specific rule specification.
  3. Spec *api.Rule
  4. // Specs is a list of desired Cilium specific rule specification.
  5. Specs api.Rules
  6. // Status is the status of the Cilium policy rule.
  7. //
  8. // The reason this field exists in this structure is due a bug in the k8s
  9. // code-generator that doesn't create a `UpdateStatus` method because the
  10. // field does not exist in the structure.
  11. //
  12. // +kubebuilder:validation:Optional
  13. Status CiliumNetworkPolicyStatus
  14. }