NetworkPolicy

Before creating NetworkPolicy objects, make sure you are using a networking solution which supports NetworkPolicy. Network isolation is controlled entirely by NetworkPolicy objects. By default, all vmis in a namespace are accessible from other vmis and network endpoints. To isolate one or more vmis in a project, you can create NetworkPolicy objects in that namespace to indicate the allowed incoming connections.

Note: vmis and pods are treated equally by network policies, since labels are passed through to the pods which contain the running vmi. With other words, labels on vmis can be matched by spec.podSelector on the policy.

Create NetworkPolicy to Deny All Traffic

To make a project “deny by default” add a NetworkPolicy object that matches all vmis but accepts no traffic.

  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4.   name: deny-by-default
  5. spec:
  6.   podSelector: {}
  7.   ingress: []

Create NetworkPolicy to only Accept connections from vmis within namespaces

  1. To make vmis accept connections from other vmis in the same namespace,
  2. but reject all other connections from vmis in other namespaces:
  4. ....
  5. kind: NetworkPolicy
  6. apiVersion: networking.k8s.io/v1
  7. metadata:
  8.   name: allow-same-namespace
  9. spec:
  10.   podSelector: {}
  11.   ingress:
  12.   - from:
  13.     - podSelector: {}
  14. ....
  16. Create NetworkPolicy to only allow HTTP and HTTPS traffic

To enable only HTTP and HTTPS access to the vmis, add a NetworkPolicy object similar to:

  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4.   name: allow-http-https
  5. spec:
  6.   podSelector: {}
  7.   ingress:
  8.   - ports:
  9.     - protocol: TCP
  10.       port: 8080
  11.     - protocol: TCP
  12.       port: 8443

Create NetworkPolicy to deny traffic by labels

To make one specific vmi with a label type: test to reject all traffic from other vmis, create:

  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4.   name: deny-by-label
  5. spec:
  6.   podSelector:
  7.     matchLabels:
  8.       type: test
  9.   ingress: []

Kubernetes NetworkPolicy Documentation can be found here: Kubernetes NetworkPolicy