# Network Policies

As the service logic becomes increasingly complex, many applications require network calls between modules. Traditional external firewalls or application-based firewalls cannot meet the requirements. Network policies are urgently needed between modules, service logic layers, or functional teams in a large cluster.

CCE has enhanced the Kubernetes-based network policy feature, allowing network isolation in a cluster by configuring network policies. This means that a firewall can be set between pods.

For example, to make a payment system accessible only to specified components for security purposes, you can configure network policies.

#### Notes and Constraints

- Only clusters that use the tunnel network model support network policies.
- Network isolation is not supported for IPv6 addresses.
- Network policies do not support egress rules except for clusters of v1.23 or later.

  Egress rules are supported only in the following operating systems:

  - EulerOS 2.9: kernel version 4.18.0-147.5.1.6.h541.eulerosv2r9.x86_64
  - CentOS 7.7: kernel version 3.10.0-1062.18.1.el7.x86_64
  - EulerOS 2.5: kernel version 3.10.0-862.14.1.5.h591.eulerosv2r7.x86_64
- If a cluster is upgraded to v1.23 in in-place mode, you cannot use egress rules because the node OS is not upgraded. In this case, reset the node.

#### Precautions

If no network policies have been configured for a workload, such as workload-1, other workloads in the same cluster can access workload-1.

#### Using Ingress Rules

- Using podSelector to specify the access scope

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: test-network-policy
        namespace: default
      spec:
        podSelector:                  # The rule takes effect for pods with the role=db label.
          matchLabels:
            role: db
        ingress:                      #This is an ingress rule.
        - from:
          - podSelector:              #Only traffic from the pods with the role=frontend label is allowed.
              matchLabels:
                role: frontend
          ports:                      #Only TCP can be used to access port 6379.
          - protocol: TCP
            port: 6379

  Diagram:

  Figure 1 podSelector

- Using namespaceSelector to specify the access scope

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: test-network-policy
      spec:
        podSelector:                  # The rule takes effect for pods with the role=db label.
          matchLabels:
            role: db
        ingress:                      #This is an ingress rule.
        - from:
          - namespaceSelector:        # Only traffic from the pods in the namespace with the "project=myproject" label is allowed.
              matchLabels:
                project: myproject
          ports:                      #Only TCP can be used to access port 6379.
          - protocol: TCP
            port: 6379

  Figure 2 shows how namespaceSelector selects ingress sources.

  Figure 2 namespaceSelector

#### Using Egress Rules

Egress supports not only podSelector and namespaceSelector, but also ipBlock.

Only clusters of version 1.23 or later support egress rules. Currently, only EulerOS 2.5, EulerOS 2.9, and CentOS 7.7 nodes are supported.

    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: deny-client-a-via-except-cidr-egress-rule
      namespace: default
    spec:
      policyTypes:                  # Must be specified for an egress rule.
        - Egress
      podSelector:                  # The rule takes effect for pods with the role=db label.
        matchLabels:
          role: db
      egress:                       # Egress rule
      - to:
        - ipBlock:
            cidr: 172.16.0.16/16    # Allow access to this CIDR block.
            except:
            - 172.16.0.40/32        # This CIDR block cannot be accessed. This value must fall within the range specified by cidr.

Diagram:

Figure 3 ipBlock

You can define ingress and egress in the same rule.

    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
      namespace: default
    spec:
      policyTypes:
      - Ingress
      - Egress
      podSelector:                  # The rule takes effect for pods with the role=db label.
        matchLabels:
          role: db
      ingress:                      # Ingress rule
      - from:
        - podSelector:              #Only traffic from the pods with the "role=frontend" label is allowed.
            matchLabels:
              role: frontend
        ports:                      #Only TCP can be used to access port 6379.
        - protocol: TCP
          port: 6379
      egress:                       # Egress rule
      - to:
        - podSelector:              # Only pods with the role=web label can be accessed.
            matchLabels:
              role: web

Diagram:

Figure 4 Using both ingress and egress

#### Adding a Network Policy on the Console

1. Log in to the CCE console. In the navigation pane, choose Resource Management > Network. On the Network Policies tab page, click Create Network Policy.

   - Network Policy Name: Specify a network policy name.
   - Cluster Name: Select a cluster to which the network policy belongs.
   - Namespace: Select a namespace in which the network policy is applied.
   - Workload

     Click Select Workload. In the dialog box displayed, select a workload for which the network policy is to be created, for example, workload-1. Then, click OK.

   - Rules: Click Add Rule, set the parameters listed in Table 1, and click OK.

     Table 1 Parameters for adding a rule
     Parameter | Description
     --- | ---
     Direction | Only Inbound is supported, indicating that the whitelisted workloads access the current workload (workload-1 in this example).
     Protocol | Select a protocol. Currently, the TCP and UDP protocols are supported. The ICMP protocol is not supported.
     Destination Container Port | Specify a port on which the workload in the container image listens. The Nginx application listens on port 80. If no container port is specified, all ports can be accessed by default.

     Whitelisted Workloads

     Select other workloads that can access the current workload. These workloads will access the current workload at the destination container port.
     - Namespace: All workloads in the selected namespace(s) are added to the whitelist. That is, all workloads in the namespace(s) can access workload-1.
     - Workload: The selected workloads can access workload-1. Only other workloads in the same namespace as workload-1 can be selected.

2. Click Create.
3. Repeat the preceding steps to add more network policies for the current workload when other ports need to be accessed by some workloads.

   After the network policies are created, only the specified workloads or workloads in the specified namespaces can access the current workload.

Parent topic: Networking