Cilium: Up and Running

Chapter 13. Layer 7 and FQDN Policy

In this chapter, we’ll cover a number of advanced use cases for network policy that build on the foundation of network policy we established in Chapter 12. If you haven’t read that chapter, you should at least be familiar with how rules are structured and how the policy datapath works. Our focus here will be on layer 7 policy for HTTP, HTTPS, DNS, and FQDN policy. All the manifests for this chapter are in the chapter13 directory of the book’s GitHub repository.

Layer 7 Policy

In the previous chapter, we applied policy purely at layer 3. We used various ways of understanding the identity of the traffic, such as toEndpoints, toEntities, and toCIDR egress rule statements and their ingress equivalents, but ultimately all of the policy we’ve applied has acted based on the IP address and port information in the packet.

If we can uniquely identify all of the resources we want to secure purely based on these factors, that’s great—but often we need to go further. For example, what if we want a workload’s access to an external service to be read-only? If it’s a service over HTTP, we can limit egress to only the relevant IP address or identity and only TCP port 80, but our policy will apply equally to GET and POST requests. Similarly, such a policy will not allow us to restrict access to only some URL paths, such as /api. What if we wanted to secure an HTTP server where we expect different clients to use different paths? Or what if multiple virtual servers ...