How deeply does Kubernetes in Action, Second Edition cover network isolation?

Explains default cross-namespace reachability and NetworkPolicy’s purpose, but stops short of policy syntax and implementation.

Network isolation

As explained in Kubernetes in Action, Second Edition

Network isolation is the restriction of network communication so that a pod can communicate only with explicitly permitted pods.

Network isolation restricts communication so that pods can connect only to explicitly permitted pods. Kubernetes does not isolate pod networks by default: a pod can communicate with pods in other namespaces unless a NetworkPolicy changes that behavior. section 7.1.4

Namespaces separate names and resources, but they do not create network or physical isolation. Pods in different namespaces may share a node and communicate across namespace boundaries. Use separate physical clusters for stronger production, staging, and development separation. section 7.1.4

Testing the default network path

A temporary client pod can reach another pod directly by IP and port, demonstrating the default pod-to-pod connectivity. Network isolation requires explicitly configuring which such connections are allowed. section 5.3.1 section 7.1.4

$ kubectl get pods -A
NAMESPACE     NAME        READY   STATUS    RESTARTS   AGE
default       kiada-ssl   2/2     Running   0          8h      #1
default       quiz        2/2     Running   0          8h
default       quote       2/2     Running   0          8h
kiada-test1   kiada-ssl   2/2     Running   0          2m     
kiada-test2   kiada-ssl   2/2     Running   0          1m     
...

Inspecting pods across namespaces makes shared cluster placement and the absence of namespace-based network isolation concrete. section 7.1.4

How Kubernetes in Action, Second Edition covers it

Cover of Kubernetes in Action, Second Edition

liveBook manning.com

Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

MongoDB 8.0 in Action, Third EditionNetwork isolation is the restriction of communication paths so that protected systems are reachable only through permitted network boundaries.

Compare how 2 books explain network isolation →

Related concepts

proxyuses · A proxy is an intermediary object or component that represents another object or system and mediates interactions with it.
network policyconfigured by · A network policy is a set of rules that permits or denies network traffic to and from selected workloads or endpoints.
isolationkind of · Isolation is the separation of components, processes, resources, or contexts to limit interaction, interference, or the propagation of effects between them.
namespacecontrasts with · A namespace is a naming context or identifier space in which names are defined and resolved, distinguishing them from names in other contexts.
defense in depthused by · Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
IP access listuses · An IP access list is a set of network addresses permitted to connect to a protected service or deployment.

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.