🏠 Back to Blog

Network Policy

https://docs.cilium.io/en/latest/security/policy/

Limitations of K8s Native NetworkPolicy Primitives

Kubernetes-native NetworkPolicy only operates at layer 3/4 (scope to IP addresses and/or TCP/UDP ports)
Cannot match on DNS
Cannot match on ICMP
No ‘deny’ options
NetworkPolicy operates at a namespace level. There is no “cluster level” option

Examples

Deny All Inbound Traffic to a the frontend pods in the dev namespace

apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "external-lockdown"
  namespace: dev
spec:
  endpointSelector: 
    matchLabels:
      role: frontend
  ingressDeny:
  - fromEntities:
    - "world"
  ingress:
  - fromEntities:
    - "all"

Deny policies do not support enforcement at layer 7
If you deny all egress traffic, DNS resolution to cluster dns (CoreDNS) is also blocked :)

Allow all traffic from the frontend pods in the dev namespace on port 80

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "allow-http-out"
  namespace: dev
spec:
  endpointSelector:
    matchLabels:
      role: frontend
  toPorts:
    - ports:
      - port: 80
        protocol: TCP

Policy Audit Mode

With policy audit mode configured, traffic is logged but not acted upon (i.e. dropped). In the cilium configmap:
```
policyAuditMode: true
```
You can then view the traffic flows in hubble