Configuring Network Policies to Restrict Pod Access

For example, a pod labeled role=db exposes port 6379 and accepts traffic only from pods labeled role=frontend. To achieve this, take the following steps:

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Policies in the navigation pane, click the Network Policies tab, and click Create Network Policy in the upper right corner.
3. Configure network policy parameters.

   Table 1 Parameters for creating a network policy

   Parameter	Description	Example
   Policy Name	Customize the name for the network policy.	access-ingress1
   Namespace	Select the namespace where the policy applies.	default
   Selector	Enter a label selector for the target pod and click Add. If left empty, all pods in the namespace are selected. Click Reference Workload Label to use an existing workload's label.	Key: role Value: db
   Inbound Rule	Click to add an inbound rule.	Table 2
   Outbound Rule	Click to add an outbound rule.	N/A

   Table 2 Parameters for adding an inbound rule

   Parameter	Description	Example
   Protocol & Port	Select the protocol type and port. TCP and UDP are supported.	Protocol: TCP Port: 6379
   Source CIDR Block	For clusters v1.27.16-r10, v1.28.15-r0, v1.29.10-r0, v1.30.6-r0, or later versions with DataPlane V2 enabled, you can configure the source CIDR block. The specified source CIDR block allows traffic from a destination CIDR block (multiple exception CIDR blocks can be specified). Separate the destination and exception CIDR blocks using a vertical bar (|). If there are multiple exception CIDR blocks, separate them using commas (,). For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 allows traffic from 172.17.0.0/16 except 172.17.1.0/24 and 172.17.2.0/24.	N/A
   Source Namespace	Select a namespace whose objects can be accessed. It defaults to the policy's namespace if unspecified.	default
   Source Pod Label	Enter a label selector for the allowed source pods and click Add. If left empty, all pods in the source namespace are permitted.	Key: role Value: frontend

4. Click OK.

1. Create the access-ingress1.yaml file.

   vim access-ingress1.yaml
   
   

   File content:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: access-ingress1
     namespace: default
   spec:
     podSelector:                  # This rule applies only to pods labeled  role=db .
       matchLabels:
         role: db
     ingress:                      # This is an ingress rule.
     - from:
       - podSelector:              # Allow access only from pods labeled  role=frontend .
           matchLabels:
             role: frontend
       ports:                      # Only TCP can be used to access port 6379.
       - protocol: TCP
         port: 6379
   
   

2. Run the following command to create the network policy defined in the access-ingress1.yaml file:

   kubectl apply -f access-ingress1.yaml
   
   

   Expected output:

   networkpolicy.networking.k8s.io/access-ingress1 created
   
   

The pod labeled role=db only permits access to its port 6379 from pods in the namespace labeled project=myproject. To achieve this, take the following steps:

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Policies in the navigation pane, click the Network Policies tab, and click Create Network Policy in the upper right corner.
3. Configure network policy parameters.

   Table 3 Parameters for creating a network policy

   Parameter	Description	Example
   Policy Name	Customize the name for the network policy.	access-ingress2
   Namespace	Select the namespace where the policy applies.	default
   Selector	Enter a label selector for the target pod and click Add. If left empty, all pods in the namespace are selected. Click Reference Workload Label to use an existing workload's label.	Key: role Value: db
   Inbound Rule	Click to add an inbound rule.	Table 4
   Outbound Rule	Click to add an outbound rule.	N/A

   Table 4 Parameters for adding an inbound rule

   Parameter	Description	Example
   Protocol & Port	Select the protocol type and port. TCP and UDP are supported.	Protocol: TCP Port: 6379
   Source CIDR Block	For clusters v1.27.16-r10, v1.28.15-r0, v1.29.10-r0, v1.30.6-r0, or later versions with DataPlane V2 enabled, you can configure the source CIDR block. The specified source CIDR block allows traffic from a destination CIDR block (multiple exception CIDR blocks can be specified). Separate the destination and exception CIDR blocks using a vertical bar (|). If there are multiple exception CIDR blocks, separate them using commas (,). For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 allows traffic from 172.17.0.0/16 except 172.17.1.0/24 and 172.17.2.0/24.	N/A
   Source Namespace	Select a namespace whose objects can be accessed. It defaults to the policy's namespace if unspecified.	myproject
   Source Pod Label	Enter a label selector for the allowed source pods and click Add. If left empty, all pods in the source namespace are permitted.	N/A

4. Click OK.

1. Create the access-ingress2.yaml file.

   vim access-ingress2.yaml
   
   

   File content:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: access-ingress2
   spec:
     podSelector:                  # This rule applies only to pods labeled  role=db .
       matchLabels:
         role: db
     ingress:                      # This is an ingress rule.
     - from:
       - namespaceSelector:        # Allow access only from pods in namespaces labeled  project=myproject .
           matchLabels:
             project: myproject
       ports:                      # Only TCP can be used to access port 6379.
       - protocol: TCP
         port: 6379
   
   

2. Run the following command to create the network policy defined in the access-ingress2.yaml file:

   kubectl apply -f access-ingress2.yaml
   
   

   Expected output:

   networkpolicy.networking.k8s.io/access-ingress2 created
   
   

The pod labeled role=db only allows access to its port 6379 from pods with label role=frontend in the namespace labeled project=myproject. To achieve this, take the following steps:

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Policies in the navigation pane, click the Network Policies tab, and click Create Network Policy in the upper right corner.
3. Configure network policy parameters.

   Table 5 Parameters for creating a network policy

   Parameter	Description	Example
   Policy Name	Customize the name for the network policy.	access-ingress3
   Namespace	Select the namespace where the policy applies.	default
   Selector	Enter a label selector for the target pod and click Add. If left empty, all pods in the namespace are selected. Click Reference Workload Label to use an existing workload's label.	Key: role Value: db
   Inbound Rule	Click to add an inbound rule.	Table 6
   Outbound Rule	Click to add an outbound rule.	N/A

   Table 6 Parameters for adding an inbound rule

   Parameter	Description	Example
   Protocol & Port	Select the protocol type and port. TCP and UDP are supported.	Protocol: TCP Port: 6379
   Source CIDR Block	For clusters v1.27.16-r10, v1.28.15-r0, v1.29.10-r0, v1.30.6-r0, or later versions with DataPlane V2 enabled, you can configure the source CIDR block. The specified source CIDR block allows traffic from a destination CIDR block (multiple exception CIDR blocks can be specified). Separate the destination and exception CIDR blocks using a vertical bar (|). If there are multiple exception CIDR blocks, separate them using commas (,). For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 allows traffic from 172.17.0.0/16 except 172.17.1.0/24 and 172.17.2.0/24.	N/A
   Source Namespace	Select a namespace whose objects can be accessed. It defaults to the policy's namespace if unspecified.	myproject
   Source Pod Label	Enter a label selector for the allowed source pods and click Add. If left empty, all pods in the source namespace are permitted.	Key: role Value: frontend

4. Click OK.

1. Create the access-ingress3.yaml file.

   vim access-ingress3.yaml
   
   

   File content:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: access-ingress3
   spec:
     podSelector:                  # This rule applies only to pods labeled  role=db .
       matchLabels:
         role: db
     ingress:                      # This is an ingress rule.
     - from:
       - namespaceSelector:        # Allow access only from pods in namespaces labeled  project=myproject .
           matchLabels:
             project: myproject
         podSelector:              # Allow access only from pods labeled  role=frontend .
           matchLabels:
             role: frontend
       ports:                      # Only TCP can be used to access port 6379.
       - protocol: TCP
         port: 6379
   
   

2. Run the following command to create the network policy defined in the access-ingress3.yaml file:

   kubectl apply -f access-ingress3.yaml
   
   

   Expected output:

   networkpolicy.networking.k8s.io/access-ingress3 created
   
   

The pods labeled role=db only allow access to 172.16.0.0/16, excluding 172.16.0.40/32. To achieve this, take the following steps:

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Policies in the navigation pane, click the Network Policies tab, and click Create Network Policy in the upper right corner.
3. Configure network policy parameters.

   Table 7 Parameters for creating a network policy

   Parameter	Description	Example
   Policy Name	Customize the name for the network policy.	access-ingress3
   Namespace	Select the namespace where the policy applies.	default
   Selector	Enter a label selector for the target pod and click Add. If left empty, all pods in the namespace are selected. Click Reference Workload Label to use an existing workload's label.	Key: role Value: db
   Inbound Rule	Click to add an inbound rule.	N/A
   Outbound Rule	Click to add an outbound rule.	Table 8

   Table 8 Parameters for adding an outbound rule

   Parameter	Description	Example
   Protocol & Port	Select the protocol type and port. TCP and UDP are supported. If unspecified, all protocols and ports are permitted.	N/A
   Destination CIDR Block	Allow requests to be routed to a specified CIDR block (and not to the exception CIDR blocks). Separate the destination and exception CIDR blocks using a vertical bar (|). If there are multiple exception CIDR blocks, separate them using commas (,). For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 allows 172.17.0.0/16 except 172.17.1.0/24 and 172.17.2.0/24.	172.16.0.0/16|172.16.0.40/32
   Destination Namespace	Select a namespace whose objects can be accessed. It defaults to the policy's namespace if unspecified.	N/A
   Destination Pod Label	Label selector for the target pod permitted by this rule. If left empty, all pods in the destination namespace are allowed.	N/A

4. Click OK.

1. Create the access-egress1.yaml file.

   vim access-egress1.yaml
   
   

   File content:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: access-egress1
     namespace: default
   spec:
     policyTypes:                  # Must be specified for egress rules.
       - Egress
     podSelector:                  # This rule applies only to pods labeled  role=db .
       matchLabels:
         role: db
     egress:                       # This is an egress rule.
     - to:
       - ipBlock:
           cidr: 172.16.0.0/16    # Allows outbound traffic to this CIDR block.
           except:
           - 172.16.0.40/32        # Blocks access to this CIDR block, which is in the range specified by the  cidr  parameter.
   
   

2. Run the following command to create the network policy defined in the access-egress1.yaml file:

   kubectl apply -f access-egress1.yaml
   
   

   Expected output:

   networkpolicy.networking.k8s.io/access-egress1 created
   
   

The pod labeled role=db only permits access to its port 6379 from pods labeled role=frontend, and this pod can only access the pods labeled role=web. You can use the same rule to configure both ingress and egress in a network policy. To achieve this, take the following steps:

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Policies in the navigation pane, click the Network Policies tab, and click Create Network Policy in the upper right corner.
3. Configure network policy parameters.

   Table 9 Parameters for creating a network policy

   Parameter	Description	Example
   Policy Name	Customize the name for the network policy.	access-ingress3
   Namespace	Select the namespace where the policy applies.	default
   Selector	Enter a label selector for the target pod and click Add. If left empty, all pods in the namespace are selected. Click Reference Workload Label to use an existing workload's label.	Key: role Value: db
   Inbound Rule	Click to add an inbound rule.	Table 10
   Outbound Rule	Click to add an outbound rule.	Table 11

   Table 10 Parameters for adding an inbound rule

   Parameter	Description	Example
   Protocol & Port	Select the protocol type and port. TCP and UDP are supported.	Protocol: TCP Port: 6379
   Source CIDR Block	For clusters v1.27.16-r10, v1.28.15-r0, v1.29.10-r0, v1.30.6-r0, or later versions with DataPlane V2 enabled, you can configure the source CIDR block. The specified source CIDR block allows traffic from a destination CIDR block (multiple exception CIDR blocks can be specified). Separate the destination and exception CIDR blocks using a vertical bar (|). If there are multiple exception CIDR blocks, separate them using commas (,). For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 allows traffic from 172.17.0.0/16 except 172.17.1.0/24 and 172.17.2.0/24.	N/A
   Source Namespace	Select a namespace whose objects can be accessed. It defaults to the policy's namespace if unspecified.	default
   Source Pod Label	Enter a label selector for the allowed source pods and click Add. If left empty, all pods in the source namespace are permitted.	Key: role Value: frontend

   Table 11 Parameters for adding an outbound rule

   Parameter	Description	Example
   Protocol & Port	Select the protocol type and port. TCP and UDP are supported. If unspecified, all protocols and ports are permitted.	N/A
   Destination CIDR Block	Allow requests to be routed to a specified CIDR block (and not to the exception CIDR blocks). Separate the destination and exception CIDR blocks using a vertical bar (|). If there are multiple exception CIDR blocks, separate them using commas (,). For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 allows 172.17.0.0/16 except 172.17.1.0/24 and 172.17.2.0/24.	N/A
   Destination Namespace	Select a namespace whose objects can be accessed. It defaults to the policy's namespace if unspecified.	default
   Destination Pod Label	Label selector for the target pod permitted by this rule. If left empty, all pods in the destination namespace are allowed.	Key: role Value: web

4. Click OK.

1. Create the access-egress2.yaml file.

   vim access-egress2.yaml
   
   

   File content:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: access-egress2
     namespace: default
   spec:
     policyTypes:
     - Ingress
     - Egress
     podSelector:                  # This rule applies only to pods labeled  role=db .
       matchLabels:
         role: db
     ingress:                      # This is an ingress rule.
     - from:
       - podSelector:              # Allow access only from pods labeled  role=frontend .
           matchLabels:
             role: frontend
       ports:                      # Only TCP can be used to access port 6379.
       - protocol: TCP
         port: 6379
     egress:                       # This is an egress rule.
     - to:
       - podSelector:              # The rule takes effect for pods with the  role=web  label.
           matchLabels:
             role: web
   
   

2. Run the following command to create the network policy defined in the access-egress2.yaml file:

   kubectl apply -f access-egress2.yaml
   
   

   Expected output:

   networkpolicy.networking.k8s.io/access-egress2 created