Chapter 21. Multiple networks

Procedure

1. Create a policy rule:

   1. Create a <policy_name>.yaml file:

      $ touch <policy_name>.yaml

      where:

      <policy_name>

      Specifies the multi-network policy file name.

   2. Define a multi-network policy in the file that you just created, such as in the following examples:

      Deny ingress from all pods in all namespaces

      This is a fundamental policy, blocking all cross-pod networking other than cross-pod traffic allowed by the configuration of other Network Policies.

      apiVersion: k8s.cni.cncf.io/v1beta1
      kind: MultiNetworkPolicy
      metadata:
        name: deny-by-default
        annotations:
          k8s.v1.cni.cncf.io/policy-for: <network_name>
      spec:
        podSelector:
        ingress: []

      where:

      <network_name>

      Specifies the name of a network attachment definition.

      Allow ingress from all pods in the same namespace

      apiVersion: k8s.cni.cncf.io/v1beta1
      kind: MultiNetworkPolicy
      metadata:
        name: allow-same-namespace
        annotations:
          k8s.v1.cni.cncf.io/policy-for: <network_name>
      spec:
        podSelector:
        ingress:
        - from:
          - podSelector: {}

      where:

      <network_name>

      Specifies the name of a network attachment definition.

      Allow ingress traffic to one pod from a particular namespace

      This policy allows traffic to pods labelled pod-a from pods running in namespace-y.

      apiVersion: k8s.cni.cncf.io/v1beta1
      kind: MultiNetworkPolicy
      metadata:
        name: allow-traffic-pod
        annotations:
          k8s.v1.cni.cncf.io/policy-for: <network_name>
      spec:
        podSelector:
         matchLabels:
            pod: pod-a
        policyTypes:
        - Ingress
        ingress:
        - from:
          - namespaceSelector:
              matchLabels:
                 kubernetes.io/metadata.name: namespace-y

      where:

      <network_name>

      Specifies the name of a network attachment definition.

      Restrict traffic to a service

      This policy when applied ensures every pod with both labels app=bookstore and role=api can only be accessed by pods with label app=bookstore. In this example the application could be a REST API server, marked with labels app=bookstore and role=api.

      This example addresses the following use cases:

      • Restricting the traffic to a service to only the other microservices that need to use it.

      • Restricting the connections to a database to only permit the application using it.

        apiVersion: k8s.cni.cncf.io/v1beta1
        kind: MultiNetworkPolicy
        metadata:
          name: api-allow
          annotations:
            k8s.v1.cni.cncf.io/policy-for: <network_name>
        spec:
          podSelector:
            matchLabels:
              app: bookstore
              role: api
          ingress:
          - from:
              - podSelector:
                  matchLabels:
                    app: bookstore

        where:

        <network_name>

        Specifies the name of a network attachment definition.

2. To create the multi-network policy object, enter the following command:

   $ oc apply -f <policy_name>.yaml -n <namespace>

   where:

   <policy_name>

   Specifies the multi-network policy file name.

   <namespace>

   Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

   Example output

   multinetworkpolicy.k8s.cni.cncf.io/deny-by-default created

Procedure

1. Optional: To list the multi-network policy objects in a namespace, enter the following command:

   $ oc get multi-networkpolicy

   where:

   <namespace>

   Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

2. Edit the multi-network policy object.

   • If you saved the multi-network policy definition in a file, edit the file and make any necessary changes, and then enter the following command.

     $ oc apply -n <namespace> -f <policy_file>.yaml

     where:

     <namespace>

     Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

     <policy_file>

     Specifies the name of the file containing the network policy.

   • If you need to update the multi-network policy object directly, enter the following command:

     $ oc edit multi-networkpolicy <policy_name> -n <namespace>

     where:

     <policy_name>

     Specifies the name of the network policy.

     <namespace>

     Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

3. Confirm that the multi-network policy object is updated.

   $ oc describe multi-networkpolicy <policy_name> -n <namespace>

   where:

   <policy_name>

   Specifies the name of the multi-network policy.

   <namespace>

   Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

Procedure

1. Create the following YAML that defines a deny-by-default policy to deny ingress from all pods in all namespaces. Save the YAML in the deny-by-default.yaml file:

   apiVersion: k8s.cni.cncf.io/v1beta1
   kind: MultiNetworkPolicy
   metadata:
     name: deny-by-default
     namespace: default 1
     annotations:
       k8s.v1.cni.cncf.io/policy-for: <network_name> 2
   spec:
     podSelector: {} 3
     ingress: [] 4

   1

   namespace: default deploys this policy to the default namespace.

   2

   network_name: specifies the name of a network attachment definition.

   3

   podSelector: is empty, this means it matches all the pods. Therefore, the policy applies to all pods in the default namespace.

   4

   There are no ingress rules specified. This causes incoming traffic to be dropped to all pods.

2. Apply the policy by entering the following command:

   $ oc apply -f deny-by-default.yaml

   Example output

   multinetworkpolicy.k8s.cni.cncf.io/deny-by-default created

Procedure

1. Create a policy that allows traffic from the public Internet directly or by using a load balancer to access the pod. Save the YAML in the web-allow-external.yaml file:

   apiVersion: k8s.cni.cncf.io/v1beta1
   kind: MultiNetworkPolicy
   metadata:
     name: web-allow-external
     namespace: default
     annotations:
       k8s.v1.cni.cncf.io/policy-for: <network_name>
   spec:
     policyTypes:
     - Ingress
     podSelector:
       matchLabels:
         app: web
     ingress:
       - {}

2. Apply the policy by entering the following command:

   $ oc apply -f web-allow-external.yaml

   Example output

   multinetworkpolicy.k8s.cni.cncf.io/web-allow-external created

Procedure

1. Create a policy that allows traffic from all pods in all namespaces to a particular application. Save the YAML in the web-allow-all-namespaces.yaml file:

   apiVersion: k8s.cni.cncf.io/v1beta1
   kind: MultiNetworkPolicy
   metadata:
     name: web-allow-all-namespaces
     namespace: default
     annotations:
       k8s.v1.cni.cncf.io/policy-for: <network_name>
   spec:
     podSelector:
       matchLabels:
         app: web 1
     policyTypes:
     - Ingress
     ingress:
     - from:
       - namespaceSelector: {} 2

   1

   Applies the policy only to app:web pods in default namespace.

   2

   Selects all pods in all namespaces.

   Note

   By default, if you omit specifying a namespaceSelector it does not select any namespaces, which means the policy allows traffic only from the namespace the network policy is deployed to.

2. Apply the policy by entering the following command:

   $ oc apply -f web-allow-all-namespaces.yaml

   Example output

   multinetworkpolicy.k8s.cni.cncf.io/web-allow-all-namespaces created

Verification

1. Start a web service in the default namespace by entering the following command:

   $ oc run web --namespace=default --image=nginx --labels="app=web" --expose --port=80

2. Run the following command to deploy an alpine image in the secondary namespace and to start a shell:

   $ oc run test-$RANDOM --namespace=secondary --rm -i -t --image=alpine -- sh

3. Run the following command in the shell and observe that the request is allowed:

   # wget -qO- --timeout=2 http://web.default

   Expected output

   <!DOCTYPE html>
   <html>
   <head>
   <title>Welcome to nginx!</title>
   <style>
   html { color-scheme: light dark; }
   body { width: 35em; margin: 0 auto;
   font-family: Tahoma, Verdana, Arial, sans-serif; }
   </style>
   </head>
   <body>
   <h1>Welcome to nginx!</h1>
   <p>If you see this page, the nginx web server is successfully installed and
   working. Further configuration is required.</p>
   
   <p>For online documentation and support please refer to
   <a href="http://nginx.org/">nginx.org</a>.<br/>
   Commercial support is available at
   <a href="http://nginx.com/">nginx.com</a>.</p>
   
   <p><em>Thank you for using nginx.</em></p>
   </body>
   </html>

Procedure

1. Create a policy that allows traffic from all pods in a particular namespaces with a label purpose=production. Save the YAML in the web-allow-prod.yaml file:

   apiVersion: k8s.cni.cncf.io/v1beta1
   kind: MultiNetworkPolicy
   metadata:
     name: web-allow-prod
     namespace: default
     annotations:
       k8s.v1.cni.cncf.io/policy-for: <network_name>
   spec:
     podSelector:
       matchLabels:
         app: web 1
     policyTypes:
     - Ingress
     ingress:
     - from:
       - namespaceSelector:
           matchLabels:
             purpose: production 2

   1

   Applies the policy only to app:web pods in the default namespace.

   2

   Restricts traffic to only pods in namespaces that have the label purpose=production.

2. Apply the policy by entering the following command:

   $ oc apply -f web-allow-prod.yaml

   Example output

   multinetworkpolicy.k8s.cni.cncf.io/web-allow-prod created

Verification

1. Start a web service in the default namespace by entering the following command:

   $ oc run web --namespace=default --image=nginx --labels="app=web" --expose --port=80

2. Run the following command to create the prod namespace:

   $ oc create namespace prod

3. Run the following command to label the prod namespace:

   $ oc label namespace/prod purpose=production

4. Run the following command to create the dev namespace:

   $ oc create namespace dev

5. Run the following command to label the dev namespace:

   $ oc label namespace/dev purpose=testing

6. Run the following command to deploy an alpine image in the dev namespace and to start a shell:

   $ oc run test-$RANDOM --namespace=dev --rm -i -t --image=alpine -- sh

7. Run the following command in the shell and observe that the request is blocked:

   # wget -qO- --timeout=2 http://web.default

   Expected output

   wget: download timed out

8. Run the following command to deploy an alpine image in the prod namespace and start a shell:

   $ oc run test-$RANDOM --namespace=prod --rm -i -t --image=alpine -- sh

9. Run the following command in the shell and observe that the request is allowed:

   # wget -qO- --timeout=2 http://web.default

   Expected output

   <!DOCTYPE html>
   <html>
   <head>
   <title>Welcome to nginx!</title>
   <style>
   html { color-scheme: light dark; }
   body { width: 35em; margin: 0 auto;
   font-family: Tahoma, Verdana, Arial, sans-serif; }
   </style>
   </head>
   <body>
   <h1>Welcome to nginx!</h1>
   <p>If you see this page, the nginx web server is successfully installed and
   working. Further configuration is required.</p>
   
   <p>For online documentation and support please refer to
   <a href="http://nginx.org/">nginx.org</a>.<br/>
   Commercial support is available at
   <a href="http://nginx.com/">nginx.com</a>.</p>
   
   <p><em>Thank you for using nginx.</em></p>
   </body>
   </html>