Network Policy

Network Policy An architecture diagram generated by Archify. podSelector · Target Pods (app: api) · Network Policy Configuration podSelector Target Pods (app: api) policyTypes · Ingress / Egress · Network Policy Configuration policyTypes Ingress / Egress NetworkPolicy · api-allow · Network Policy Configuration · policy NetworkPolicy api-allow policy ingress · Inbound Rules · Network Policy Configuration ingress Inbound Rules egress · Outbound Rules · Network Policy Configuration egress Outbound Rules from · podSelector · namespaceSelector · ipBlock · Inbound Rules from podSelector · namespaceSelector · ipBlock ports · Allowed ports (8080/TCP) · Inbound Rules ports Allowed ports (8080/TCP) to · podSelector · namespaceSelector · ipBlock · Outbound Rules to podSelector · namespaceSelector · ipBlock ports · Allowed ports (5432/TCP) · Outbound Rules ports Allowed ports (5432/TCP) Frontend Pod · app: frontend · Architecture component Frontend Pod app: frontend API Pod · app: api · Architecture component API Pod app: api Database Pod · app: database · Architecture component Database Pod app: database selects defines rules rules source ports destination ports traffic (8080/TCP) traffic (5432/TCP) applies to Network Policy Configuration Inbound Rules Outbound Rules Legend Frontend Backend Database Security

Target selection

  • • podSelector picks Pods labeled app: api
  • • policyTypes declares both Ingress and Egress

Inbound (ingress)

  • • from: only Pods labeled app: frontend are allowed as source
  • • ports: only 8080/TCP is allowed

Outbound (egress)

  • • to: only Pods labeled app: database are allowed as destination
  • • ports: only 5432/TCP is allowed
  • • Requires a CNI plugin that supports network policies (Calico, Cilium, Antrea, ...)