A network policy is a namespaced Kubernetes API object that controls traffic to and from selected pods. It can restrict pod-to-pod communication, filter ingress or egress by port, isolate namespaces, and block external access. section 6.6 section 6.8
Use these controls to define permitted communication:
- Select destination pods with podSelector; combine ingress and egress rules with namespace selectors or IP blocks. section 6.6 section 6.8
- Treat an empty podSelector with both policy types as a default-deny policy for the namespace. section 6.6
Allow busybox to reach nginx
Create an ingress policy selecting nginx and permitting TCP port 80 from the busybox selector. Add a matching egress policy selecting busybox and permitting TCP port 80 to nginx. A wget request initially times out under default deny, then returns the nginx page after both policies are applied.
|
Competency
|
Chapter section
|
|---|---|
| Understand host networking configuration on the cluster nodes |
6.5 |
| Understand connectivity between pods |
6.2 |
| Use ClusterIP, NodePort, and LoadBalancer Service types and endpoints |
6.4 |
| Know how to use ingress controllers and ingress resources |
6.3 |
Understand and use CoreDNS |
6.1, 6.2 |
| Choose an appropriate container network interface plugin |
6.5 |
| Define and enforce Network Policies |
6.6 |
| Use the Gateway API to manage ingress traffic |
6.7 |
Use the networking competency map to locate Network Policies alongside pod connectivity, CNI selection, Services, CoreDNS, ingress, and Gateway API tasks. section 6.0
