NetworkPolicy Spec and Traffic Flow

NetworkPolicy Spec and Traffic Flow An architecture diagram generated by Archify. NetworkPolicy · api-allow · Network Policy Configuration NetworkPolicy api-allow podSelector · target pods (app: api) · Network Policy Configuration podSelector target pods (app: api) policyTypes · Ingress / Egress · Network Policy Configuration policyTypes Ingress / Egress ingress · inbound rules · Network Policy Configuration ingress inbound rules egress · outbound rules · Network Policy Configuration egress outbound rules Frontend Pod · app: frontend · Traffic Flow Frontend Pod app: frontend API Pod · app: api · Traffic Flow API Pod app: api Database Pod · app: database · Traffic Flow Database Pod app: database Selectors · targets in rule from / to · Selector Types Selectors targets in rule from / to podSelector · pod labels · Selector Types podSelector pod labels namespaceSelector · namespace labels · Selector Types namespaceSelector namespace labels ipBlock · IP CIDR range · Selector Types ipBlock IP CIDR range applied to inbound allowed :8080 outbound allowed :5432 not selected by this policy Network Policy Configuration Traffic Flow Selector Types Legend Frontend Backend Database Policy/selector

api-allow example policy

  • • Applies to pods labeled app: api; policyTypes are Ingress and Egress
  • • Allows only inbound traffic from app: frontend pods on TCP 8080
  • • Allows only outbound traffic to app: database pods on TCP 5432

Selectors and prerequisites

  • • podSelector, namespaceSelector and ipBlock can be combined in from/to
  • • By default all pods can talk to each other; network policies restrict this
  • • Requires a CNI plugin that supports network policies (Calico, Cilium, Antrea)