Network Policies in AKS

Ovidiu Borlean
3 min readAug 2, 2022

--

In order to have a better network segregation at the AKS cluster level, we can make use of native Kubernetes technology: Network Policies.

Network isolation can be created on both ingress and egress traffic and can filter traffic based on namespaces, pod selectors, ip addresses.

For testing purpose we can use the following Deployment manifest file. It will deploy the desired number of Replicas on the cluster level, will use nginx image as a base layer and will install some networking testing tools: netcat, tcptraceroute.

After deploying this resource, every running Pod will have a container that will listen to port 8888 (configurable value)

For our tests, we will deploy two namespaces, prod and dev.

# kubectl create namespace prod

# kubectl create namespace dev

For our example we will deploy a two replicas Deployment in both namespaces (prod and dev).

Namespace dev:

NAME READY STATUS RESTARTS AGE

dev netest-778c8b549c-gzbtz 1/1 Running 0 3m45s 10.224.0.114 aks-nodepool1–15674456-vmss000003 <none> <none>

dev netest-778c8b549c-kvwww 1/1 Running 0 3m45s 10.224.0.110 aks-nodepool1–15674456-vmss000003 <none> <none>

Namespace prod:

NAME READY STATUS RESTARTS AGE

prod netest-778c8b549c-4zxvq 1/1 Running 0 3m46s 10.224.0.125 aks-nodepool1–15674456-vmss000003 <none> <none>

prod netest-778c8b549c-qh795 1/1 Running 0 3m46s 10.224.0.119 aks-nodepool1–15674456-vmss000003 <none> <none>

We will connect on first Pod (netest-778c8b549c-gzbtz — 10.224.0.114) on dev namespace and will test network connectivity toward the first Pod in the prod namespace (netest-778c8b549c-4zxvq — 10.224.0.125)

root@netest-778c8b549c-gzbtz:/# nc -zv 10.224.0.125 8888

Connection to 10.224.0.125 8888 port [tcp/*] succeeded!

We can observe that the connection succeeded.

apiVersion: apps/v1
kind: Deployment
metadata:
creationTimestamp: null
labels:
app: netest
name: netest
spec:
replicas: 3
selector:
matchLabels:
app: netest
strategy: {}
template:
metadata:
creationTimestamp: null
labels:
app: netest
spec:
containers:
— image: nginx
name: nginx
command: [“/bin/bash”]
args: [“-c”, “apt update && apt install netcat -y && apt install tcptraceroute -y && while true; do printf ‘HTTP/1.1 200 OK SALUT’ | nc -l 8888; done”]
resources: {}
status: {}

We will label the dev namespace with following value, same thing will do for prod namespace but with a different value.

k label namespace dev ns=dev

k label namespace prod ns=prod

we will deploy a different namespace called demo in order to execute networking tests for our network policies:

k create ns demo

kubectl apply -f netest.yaml -n demo

We will connect to first Pod in this new namespace and will try to test connectivity toward our Pods in dev namespace

ovidiu@cc-ad7bec5e-545f66c74f-mncvt:~/netpol$ k exec -it netest-778c8b549c-kk4zt -n demo — bash

root@netest-778c8b549c-kk4zt:/# nc 10.224.0.114 8888

Our connectivity from our demo namespace is failing because of applied policy

If we test from prod namespace, everything is working as expected:

ovidiu@cc-ad7bec5e-545f66c74f-mncvt:~/netpol$ k exec -it netest-778c8b549c-4zxvq -n prod — bash

root@netest-778c8b549c-4zxvq:/# nc 10.224.0.114 8888

HTTP/1.1 200 OK SALUT

We will test now the selection based on Pod selectors (labels)

Creating and installing the following Network Policy on the prod namespace:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: prodtest

namespace: prod

spec:

podSelector: {}

policyTypes:

- Ingress

- Egress

ingress:

- from:

- podSelector:

matchLabels:

app: frontend

egress:

  • {}

Creating a nginx Pod in prod namespace for testing connectivity toward other resources.

kubectl run nginx — image=nginx

kubectl exec -it nginx — bash

Testing connectivity toward the firs Pod in prod namespace:

root@nginx:/# nc -zv 10.224.0.125 8888

nc: connect to 10.224.0.125 port 8888 (tcp) failed: Connection timed out

As our traffic is coming from a Pod without label app: frontend, it is denied. After we apply the correct label on our Pod, we test again connectivity inside the same namespace:

kubectl label pod nginx -n prod app=frontend

root@nginx:/# netcat -zv 10.224.0.125 8888

Connection to 10.224.0.125 8888 port [tcp/*] succeeded!

There are multiple policies that could be applied on a Kubernetes cluster.

Please find a complete documentation on the Kubernetes official documentation:

https://kubernetes.io/docs/concepts/services-networking/network-policies/

--

--

No responses yet