website/docs/user-guide/networkpolicies.md

---

---

• TOC {:toc}

What is a Network Policy?

A Network Policy is a specification of how groupings of pods are allowed to communicate with each other and other network endpoints.

NetworkPolicy resources use labels to select pods and define whitelist rules which allow traffic to the selected pods in addition to what is allowed by the ingress isolation policy for a given namespace.

Prerequisites

Before you start using the NetworkPolicy resource, there are a few things to understand. The NetworkPolicy resource is a beta resource and is not available in any Kubernetes release prior to 1.3.

You must enable the extensions/v1beta/networkpolicies runtime config in your apiserver to enable this resource.

You must also be using a networking solution which supports Network Policy - simply creating the resource without a controller to implement it will have no effect.

Configuring Namespace Isolation Policy

Ingress isolation can be configured on a per-namespace basis. Once ingress isolation is configured on a namespace it will be applied to all pods in that namespace.

Currently the following ingress isolation types are supported:

• DefaultDeny: Pods in the namespace will be inaccessible from any source except the pod's local node.

Ingress isolation can be enabled using an annotation on the Namespace.

kind: Namespace
apiVersion: v1
metadata:
  annotations:
    net.beta.kubernetes.io/network-policy: |
      {
        "ingress": {
          "isolation": "DefaultDeny"
        }
      }

To configure the annotation via kubectl:

kubectl annotate ns <namespace> "net.beta.kubernetes.io/networkpolicy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}"

The NetworkPolicy Resource

A minimal NetworkPolicy might look like this:

01. apiVersion: extensions/v1beta1
02. kind: NetworkPolicy
03. metadata:
04.  name: test-network-policy
05. spec:
06.  podSelector:
07.   matchLabels:
08.     role: db
09.  ingress:
10.   - from:
11.      podSelector:
12.       matchLabels:
13.        role: frontend
14.     ports:
15.      - protocol: tcp
16.        port: 6379

POSTing this to the API server will have no effect unless your chosen networking solution supports network policy.

Lines 1-4: As with all other Kubernetes config, a NetworkPolicy needs apiVersion, kind, and metadata fields. For general information about working with config files, see here, here, and here.

Lines 5-9: NetworkPolicy spec has all the information needed to configure a loadbalancer or proxy server. Most importantly, it contains a list of rules matched against all incoming requests. Currently the Ingress resource only supports http rules.

Lines 6-8: Each NetworkPolicy includes a podSelector which selects the grouping of pods to which the ingress rules in the policy apply.

Lines 9-16: Each NetworkPolicy includes a list of whitelist ingress rules. Each rule allows traffic which matches both the from and ports sections.

Complete Specification: See the api-reference for a full definition of the resource.