Cheat notes · Module 06 · Share the cluster

Walls: NetworkPolicy and Pod Security

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

The pod network is flat until a NetworkPolicy selects a pod; then only what some policy allows gets through, and both the caller's egress and the callee's ingress must allow it. Pod Security Admission checks pods against a level set by namespace labels: warn and audit first, enforce once the pods pass.

Remember

The first policy changes the default: a pod no policy selects accepts all traffic. Once one policy selects it, it accepts only what some policy allows, in the directions (ingress, egress) that policy names.
Policies add up, with no order and no deny rule. Replies are always allowed.
The front door is a pod too: allow the traefik namespace to the pod port 9898, not the Service's 80.
Deny egress breaks DNS first: allow CoreDNS (k8s-app: kube-dns in kube-system, port 53 UDP and TCP).
One dash matters: namespaceSelector and podSelector in one list item means both; two items means either.
restricted needs: runAsNonRoot with a numeric user, allowPrivilegeEscalation: false, capabilities.drop: [ALL], seccompProfile: RuntimeDefault.
enforce rejects pods, not Deployments. Workloads only get a warning; their ReplicaSet then fails to create pods.

Pitfalls

bad address is DNS, download timed out is a blocked connection: different fixes.
Enforcing Pod Security before looking: dry-run the label first, then warn, then fix, then enforce.
Default deny ingress also closes the front door: the ingress controller needs its own allow rule.

Commands

`kubectl -n NS exec deployment/NAME -- wget -qO- -T 3 http://SVC.NS/healthz`	Test a call from inside a pod
`kubectl -n NS get networkpolicy`	The policies in a namespace
`kubectl label --dry-run=server --overwrite namespace NS pod-security.kubernetes.io/enforce=restricted`	Which pods would fail, without changing anything
`kubectl replace --dry-run=server -f FILE`	Run admission on an update, and see its warnings

tenants/checkout/networkpolicy.yaml (restrict-egress)

spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - podSelector: {}

Test yourself

Answer in your head first, then open the answer.

A namespace has no NetworkPolicy. Who can connect to its pods?

Every pod in the cluster.

When may pods in A call pods in B?

When A's egress and B's ingress both allow it (or no policy selects that pod for that direction).

A namespace enforces restricted; you apply a Deployment running as root. What happens?

The Deployment is accepted with a warning; its ReplicaSet cannot create pods.

Why do probes keep working after default deny?

They come from the kubelet on the pod's own node, which policies do not block.

Where module 06 leaves you: Both team namespaces accept traffic only from their own pods and from the ingress controller, and may only call DNS and their own pods. Both enforce Pod Security restricted. checkout and catalog run as a non-root user with no privileges, and still answer through the ingress.