Cilium: Up and Running

Chapter 12. Network Policy

Network security controls are used to protect workloads by preventing unintended access, halting lateral movement, and enforcing organizational policy. All of this can be done at the network level, reducing the need to coordinate policy across disparate teams and third-party applications. Traditional approaches are difficult to implement in a cloud native environment. Pod and service IPs can change without warning, and all pods usually occupy the same CIDR range, so external network security appliances cannot differentiate traffic from different workloads.¹

Cilium’s network policy feature, an extension of the Kubernetes NetworkPolicy, is an in-cluster replacement for these traditional controls that is deeply integrated into existing Kubernetes concepts such as namespaces, workload labels, and services.

All the manifests for this chapter are in the chapter12 directory of the book’s GitHub repository. We’ll call out the filenames you need as we refer to them, and only show the important bits here.

Creating a Basic Policy

Let’s start by creating a cluster and deploying Cilium. We don’t need any special configuration to use network policy, but see previous chapters for examples of deploying using kind.

We’ll deploy a simple web server (webserver.yaml) and protect it with network policy. As in previous chapters, we’ll use NGINX, but configured to serve text on port 8080 and metrics on port 9113. We’ll label the pod with app.kubernetes.io/name: webserver ...