Configuring Network Policies to Restrict Pod Access

Notes and Constraints

• Only clusters that use the tunnel network model support network policies. Network policies are classified into the following types:
  • Ingress: All versions support this type.
  • Egress: This rule type cannot be set currently.
• Network isolation is not supported for IPv6 addresses.

Using Ingress Rules Through YAML

• Scenario 1: Use a network policy to limit access to a pod to only pods with specific labels.
  Figure 1 podSelector
  

  The pod labeled with role=db only permits access to its port 6379 from pods labeled with role=frontend. To do so, perform the following operations:

  1. Create the access-demo1.yaml file.

     vim access-demo1.yaml

     File content:

     apiVersion: networking.k8s.io/v1
     kind: NetworkPolicy
     metadata:
       name: access-demo1
       namespace: default
     spec:
       podSelector:                  # The rule takes effect for pods with the role=db label.
         matchLabels:
           role: db
       ingress:                      # This is an ingress rule.
       - from:
         - podSelector:              # Only allow the access of the pods labeled with role=frontend.
             matchLabels:
               role: frontend
         ports:                      # Only TCP can be used to access port 6379.
         - protocol: TCP
           port: 6379

  2. Run the following command to create the network policy based on the access-demo1.yaml file:

     kubectl apply -f access-demo1.yaml

     Expected output:

     networkpolicy.networking.k8s.io/access-demo1 created

• Scenario 2: Use a network policy to limit access to a pod to only pods in a specific namespace.
  Figure 2 namespaceSelector
  

  The pod labeled with role=db only permits access to its port 6379 from pods in the namespace labeled with project=myproject. To do so, perform the following operations:

  1. Create the access-demo2.yaml file.

     vim access-demo2.yaml

     File content:

     apiVersion: networking.k8s.io/v1
     kind: NetworkPolicy
     metadata:
       name: access-demo2
     spec:
       podSelector:                  # The rule takes effect for pods with the role=db label.
         matchLabels:
           role: db
       ingress:                      # This is an ingress rule.
       - from:
         - namespaceSelector:        # Only allow the access of the pods in the namespace labeled with project=myproject.
             matchLabels:
               project: myproject
         ports:                      # Only TCP can be used to access port 6379.
         - protocol: TCP
           port: 6379

  2. Run the following command to create the network policy based on the access-demo2.yaml file:

     kubectl apply -f access-demo2.yaml

     Expected output:

     networkpolicy.networking.k8s.io/access-demo2 created

Creating a Network Policy on the Console

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Policies in the navigation pane, click the Network Policies tab, and click Create Network Policy in the upper right corner.
   • Policy Name: Specify a network policy name.
   • Namespace: Select a namespace in which the network policy is applied.
   • Selector: Enter a label, select the pod to be associated, and click Add. You can also click Reference Workload Label to use the label of an existing workload.
   • Inbound Rule: Click to add an inbound rule. For details about parameter settings, see Table 1.

     

     Table 1 Adding an inbound rule

     Parameter	Description
     Protocol & Port	Select the protocol type and port. Currently, TCP and UDP are supported.
     Source Namespace	Select a namespace whose objects can be accessed. If this parameter is not specified, the object belongs to the same namespace as the current policy.
     Source Pod Label	Allow accessing the pods with this label. If this parameter is not specified, all pods in the namespace can be accessed.

3. Click OK.