Kubernetes policy, basic tutorial

This guide provides a simple way to try out Kubernetes NetworkPolicy with Calico. It requires a Kubernetes cluster configured with Calico networking, and expects that you have kubectl configured to interact with the cluster.

You can quickly and easily deploy such a cluster by following one of the installation guides.

Configure namespaces

This guide will deploy pods in a Kubernetes namespace. Let's create the Namespace object for this guide.

kubectl create ns policy-demo

Create demo pods

We'll use Kubernetes Deployment objects to easily create pods in the namespace.

1. Create some nginx pods in the policy-demo namespace.

   kubectl create deployment --namespace=policy-demo nginx --image=nginx

2. Expose them through a service.

   kubectl expose --namespace=policy-demo deployment nginx --port=80

3. Ensure the nginx service is accessible.

   kubectl run --namespace=policy-demo access --rm -ti --image busybox /bin/sh

   This should open up a shell session inside the access pod, as shown below.

   Waiting for pod policy-demo/access-472357175-y0m47 to be running, status is Pending, pod ready: false
   
   If you don't see a command prompt, try pressing enter.
   
   / #

4. From inside the access pod, attempt to reach the nginx service.

   wget -q nginx -O -

   You should see a response from nginx. Great! Our service is accessible. You can exit the pod now.

Enable isolation

Let's turn on isolation in our policy-demo namespace. Calico will then prevent connections to pods in this namespace.

Running the following command creates a NetworkPolicy which implements a default deny behavior for all pods in the policy-demo namespace.

kubectl create -f - <<EOF
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-deny
  namespace: policy-demo
spec:
  podSelector:
    matchLabels: {}
EOF

Test Isolation

This will prevent all access to the nginx service. We can see the effect by trying to access the service again.

kubectl run --namespace=policy-demo access --rm -ti --image busybox /bin/sh

This should open up a shell session inside the access pod, as shown below.

Waiting for pod policy-demo/access-472357175-y0m47 to be running, status is Pending, pod ready: false

If you don't see a command prompt, try pressing enter.

/ #

Now from within the busybox access pod execute the following command to test access to the nginx service.

wget -q --timeout=5 nginx -O -

The request should time out after 5 seconds.

wget: download timed out
/ #

By enabling isolation on the namespace, we've prevented access to the service.

Allow access using a network policy

Now, let's enable access to the nginx service using a NetworkPolicy. This will allow incoming connections from our access pod, but not from anywhere else.

Create a network policy access-nginx with the following contents:

kubectl create -f - <<EOF
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: access-nginx
  namespace: policy-demo
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
    - from:
      - podSelector:
          matchLabels:
            run: access
EOF

note

The NetworkPolicy allows traffic from Pods with the label run: access to Pods with the label app: nginx. The labels are automatically added by kubectl and are based on the name of the resource.

We should now be able to access the service from the access pod.

kubectl run --namespace=policy-demo access --rm -ti --image busybox /bin/sh

This should open up a shell session inside the access pod, as shown below.

Waiting for pod policy-demo/access-472357175-y0m47 to be running, status is Pending, pod ready: false

If you don't see a command prompt, try pressing enter.

/ #

Now from within the busybox access pod execute the following command to test access to the nginx service.

wget -q --timeout=5 nginx -O -

However, we still cannot access the service from a pod without the label run: access. We can verify this as follows.

kubectl run --namespace=policy-demo cant-access --rm -ti --image busybox /bin/sh

This should open up a shell session inside the cant-access pod, as shown below.

Waiting for pod policy-demo/cant-access-472357175-y0m47 to be running, status is Pending, pod ready: false

If you don't see a command prompt, try pressing enter.

/ #

Now from within the busybox cant-access pod execute the following command to test access to the nginx service.

wget -q --timeout=5 nginx -O -

The request should time out.

wget: download timed out
/ #

You can clean up the demo by deleting the demo namespace.

kubectl delete ns policy-demo

This was just a simple example of the Kubernetes NetworkPolicy API and how Calico can secure your Kubernetes cluster. For more information on network policy in Kubernetes, see the Kubernetes user-guide.

For a slightly more detailed demonstration of policy, check out the Kubernetes policy demo.