Kubernetes cluster network policies

With Kubernetes network policies you can configure networking between groups of pods and network nodes. You can create network policies using the Kubernetes Network Policy API that sets rules for filtering traffic at the pod level. These rules determine which pods and services in a Kubernetes cluster can access each other.

Managed Service for Kubernetes uses the Calico and Cilium controllers to manage network policies.

The Calico network controller uses the iptables rules; Cilium uses the eBPF technology.

Integration with load balancersIntegration with load balancers

You can find step-by-step guides on how to set up access to an application using NetworkPolicy in Granting access to an application running in a Kubernetes cluster.

CalicoCalico

Calico enables you to configure basic security policies for Kubernetes clusters.

You can find step-by-step configuration guides in Configuring the Calico network policy controller.

CiliumCilium

The Cilium controller has a more advanced functionality compared to Calico. It enables you to:

• Use the same subnet ranges for pods and services in different clusters.
• Create more functional network policies, e.g., by filtering pod-to-pod traffic at the application layer (L7) or using the DNS name of the external resource.
• Use the built-in Hubble tool to monitor network events.

In a Managed Service for Kubernetes cluster, Cilium operates in tunnel mode. This mode implements network connectivity between the cluster objects based on the VxLAN technology using the Cilium CNI.

With Cilium's tunnel mode, you can:

• Create clusters with overlapping IP addresses in the same network.
• Use an extended address range of up to /8 for cluster pods and services.
• Create twice as many cluster nodes (as compared to Calico).

The cluster service account needs the k8s.tunnelClusters.agent role to use tunnel mode.

See Creating a Managed Service for Kubernetes cluster to learn how to enable tunnel mode.

Allow-all and deny-all network policiesAllow-all and deny-all network policies

Policies for incoming connectionsPolicies for incoming connections

You can create a policy that allows all incoming connections to all pods in a namespace. If such a policy is present, no other policy can ban incoming connections to these pods.

Here is an example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-ingress
spec:
  podSelector: {}
  ingress:
  - {}
  policyTypes:
  - Ingress

You can create a policy that bans all incoming connections to all pods in a namespace. Such policy ensures that all incoming connections will be banned for pods not selected by any other network policy.

Here is an example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Policies for outgoing connectionsPolicies for outgoing connections

You can create a policy that allows all outgoing connections from all pods in a namespace. If such a policy is present, no other policy can ban outgoing connections from these pods.

Here is an example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-egress
spec:
  podSelector: {}
  egress:
  - {}
  policyTypes:
  - Egress

You can create a policy that bans all outgoing connections from all pods in a namespace. Such policy ensures that all outgoing connections will be banned for pods not selected by any other network policy.

Here is an example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress

For more on NetworkPolicy, see this article.

Cluster requirements to enable network policiesCluster requirements to enable network policies

To enable network policies in a Kubernetes cluster, you need to have enough resources in node groups. Using network policies requires additional memory and vCPU resources.

We recommend that you only enable your network policy controller in a cluster of at least two nodes.