Securing Cluster Networking with Network Policies
summary
NetworkPolicy is a whitelist-only API (introduced in Kubernetes 1.3, stable in 1.7) that applies per-namespace via pod selectors and can restrict ingress and egress by pod labels, numeric ports, or CIDR/IPBlock with excepts; an empty podSelector plus no rules results in default deny. Enforcement requires a CNI implementation (examples: Calico or Romana) — deploying policies without one does nothing. Policies filter connections (not individual packets), do not retroactively kill established sessions, and commonly require explicit DNS (kube-dns) allowances. Kubernetes 1.9 promises improved tooling.
AI-written summary · about
chapters (6)
- 0:00Intro
- 2:53Labels
- 3:57Network Policy
- 17:54Network Policy Enforcement
- 21:26Best Practices
- 24:35Questions
related talks
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
36mKubernetes Security After Pod Security Policies Removal
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
36mNetwork-independent ACLs: Why Security Shouldn't Depend on Your Network
41mAdopting Network Policies for Multi-Tenant Environments
06mLightning Talk: Why Your Cluster-Wide Policies Are a Risk (And What To Do About It)
40mKubernetes Security After Pod Security Policies Removal