↓ Skip to main content
Samarthya
Samarthya
Kubernetes

NetworkPolicy: K8S

·2 mins
Technical K8s Networkpolicy
Table of Contents

How can a pod communicate with the other pod? The answer to this question is through a network policy.

Network Policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.

Like Services, it uses labels to select the pods.

The kubelet has a single default network plugin, and a default network common to the entire cluster.

Pod by default is NON-ISOLATED, implying they accept traffic from any source, by virtue of NetworkPolicy an isolation is defined.

Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy.

Network policies are additive by nature.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: my-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: my-running-pod
  policyTypes:
  - Ingress
  - Egress

Mandatory fields for a NetworkPolicy

  • apiVersion
  • kind
  • metadata

Type of Services (popular)

  1. ClusterIP

  2. NodePort

  3. LoadBalancer

podSelector
#

Each NetworkPolicy defines a podSelector, which identifies the pods to which the policy applies. In our example (above) the policy is applied to all pods with label app: my-running-pod

An empty podSelector selects all pods in the namespace.

policyTypes
#

It can be either of Ingress (default), Egress or both.

Ingress
#

Each rule allows traffic which matches both the from and ports sections.

Egress
#

Each rule allows traffic which matches both the to and ports sections.

References
#

Author
Samarthya
Engineer, learner, tinkerer. This is my trophy shelf of everyday work and leisure.

Related

Probes: K8S

Probes: K8S

·5 mins
Technical K8s Probes
In this blog we will be talking about Liveness, Readiness and Startup probes of a container. A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. — - Life without a service What is Kubelet? # Kubelet is a primary node agent that runs on every node. Works in term of PodSpec, that describes a POD (JSON or Yaml). Liveness Probe # It is used by kubelet to decide when to restart the container. periodSeconds defines when the kubelet check periodically. initialDelaySeconds specifies the initial wait before checking. I just created a single container pod that will run touch command to create a file and then it deletes that specific file after a delay, on which the livenessProbe is listening on and then once liveness fails we can check the container.
Services: K8S

Services: K8S

·3 mins
Technical K8s Service
There are multiple Kubernetes objects we will be talking about in this blog. Mainly Services, Selectors and Labels. Service is an abstraction which defines a logical set of Pods and a policy by which to access them. A Service in Kubernetes is a REST object, similar to a Pod. Service tags the pods, logically grouping them using selectors. Pods have a lifecycle, they are born, they live, process and then they die. The pods (desired state) can be managed using deployment. A label is an identifying attribute of an object, and can be defined at the creation time, and subsequently modified and added at any time. Label selector is a grouping primitive in Kubernetes and allows client/user to identify a set of objects. There are two sets of selectors equality-based and set-based. An abstract way to expose an application running on a set of Pods as a network service. The set of Pods targeted by a Service is usually determined by a selector.
K8S

K8S

·1 min
Technical Container K8s
What is K8S? # To manage distributed containerised workloads, you use Kubernetes. It is resilient declarative configuration. It is open source platform. It allows you to bundle and run your application. From the official Kubernetes documentation. Kubernetes objects # K8S objects are the persistent entities in the K8S system and thee entities are used to represent the state of the cluster.