How deeply does Google Anthos in Action cover network policy?

Explains deployment roles and GKE enforcement differences but provides no NetworkPolicy manifest or configuration walkthrough.

Network policy

As explained in Google Anthos in Action

A network policy is a configuration that controls which network connections are permitted between workloads or network endpoints.

A Kubernetes NetworkPolicy restricts traffic within a cluster. It can limit traffic between Pods and Services and control ingress and egress traffic to Pods. Use it to define workload-level boundaries alongside, not in place of, service discovery and other network controls. section 10.4.2 section 10.4.3

Choose the surrounding controls according to the traffic path:

For service-to-service traffic, use NetworkPolicy to limit which Pods and Services can communicate. A service mesh can separately provide mTLS and service-level security policies. section 10.4.2
For traffic leaving the cluster, NetworkPolicies can control Pod egress using label selectors. Firewall rules can further limit destinations reachable from node IP subnets, through which Pod egress exits. section 10.4.3
For a migrated multi-VM application, place codependent Pods in a namespace and restrict access between frontend and backend Pods with NetworkPolicy. section 15.5

Enforcement depends on the cluster data plane. GKE Dataplane v1 uses Calico and Linux iptables for NetworkPolicy enforcement; Dataplane v2 uses the Cilium agent and eBPF. Account for that implementation difference when comparing cluster networking options. section 10.2.1

Table 10.1

Network feature	Existing	New Dataplane
ClusterIP service resolution	kube-proxy using iptables	`cilium-agent` using eBPF on sockets
NodePort service resolution	kube-proxy using iptables	`cilium-agent` using eBPF on eth0 TC hooks
Load balancer service resolution	kube-proxy using iptables redirecting to service chain	`cilium-agent` using eBPF on eth0 TC hooks (same hook as previously)
Network policy enforcement	Calico using iptables	`cilium-agent` using eBPF on socket as well as eth0 TC hooks

The network-feature comparison identifies the enforcement component and mechanism used by each GKE data plane. section 10.2.1

NetworkPolicy is one Kubernetes security object, not a complete cluster-security procedure. The treatment identifies where to use it but does not supply a NetworkPolicy manifest or a step-by-step policy rollout. section 13.3.1 section 10.4.3

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Acing the Certified Kubernetes Administrator Exam, Second EditionA network policy is a Kubernetes API object that controls allowed traffic to and from pods using selectors and IP ranges.

Compare how 2 books explain network policy →

Related concepts

podconfigures · A Kubernetes Pod is the smallest deployable unit in Kubernetes, grouping one or more co-located containers that share networking and other resources.
Calicoimplemented by · Calico is an open-source networking and network-security platform for connecting and enforcing policies among containers, virtual machines, and hosts.
Flannelcontrasts with · Flannel is a container networking solution that provides virtual network connectivity for Kubernetes clusters.
network isolationconfigures · Network isolation is the restriction or separation of network communication so that systems or processes can communicate only across permitted paths or boundaries.
Kubernetes resourcekind of · A Kubernetes resource is a persistent API-managed object representing the desired or observed state of a workload, configuration, or other cluster entity.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.