Mastering Kubernetes - Second Edition

Implementing network policies

While the network policy API itself is generic and is part of the Kubernetes API, the implementation is tightly coupled to the networking solution. That means that on each node, there is a special agent or gatekeeper that does the following:

• Intercepts all traffic coming into the node
• Verifies that it adheres to the network policy
• Forwards or rejects each request

Kubernetes provides the facility to define and store network policies through the API. Enforcing the network policy is left to the networking solution or a dedicated network policy solution that is tightly integrated with the specific networking solution. Calico and Canal are good examples of this approach. Calico has its own networking solution and ...