🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🚫📝 धडा 19 — NetworkPolicies: चिठ्ठ्या पाठवण्याचे नियम

📍 तुम्ही इथे आहात: धडा 19 / 26 · मागील: lesson-18-jobs-cronjobs · पुढील: lesson-20-taints-affinity

📦 या ब्रँचमध्ये काय आहे

आधीचे सगळे, आणि cluster च्या आत कोण कोणाशी बोलू शकते यावर कुलूप. खरी file:

k8s/network-policies.yaml — default-deny + आपल्या app ला खरोखर लागणाऱ्या दोन परवानग्या

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

आश्चर्य: नव्या cluster मध्ये प्रत्येक pod प्रत्येक pod शी कुजबुजू शकतो 😳 — कोणतेही मूल कोणत्याही वर्गातल्या कोणत्याही मुलाला चिठ्ठी देऊ शकते, थेट गुणपत्रिकेच्या वहीपर्यंतसुद्धा. एक compromised pod = संपूर्ण शाळेची मोफत सफर. (Security groups बाहेरून बाकांचे रक्षण करतात; आतल्या चिठ्ठ्यांवर कोणीच लक्ष ठेवत नव्हते.)

NetworkPolicies म्हणजे चिठ्ठ्या पाठवण्याचे नियम:

पहिला लावलेला नियम: "या वर्गात अजिबात चिठ्ठ्या नाहीत" (default-deny — रिकामा selector असलेली policy, जी प्रत्येक pod निवडते). ज्या क्षणी कोणतीही policy एखादा pod निवडते, त्या क्षणी तो pod स्पष्टपणे परवानगी न दिलेले काहीही स्वीकारणे थांबवतो.
मग, वर्गाला लागतात तेवढ्याच चिठ्ठ्यांना परवानगी द्या: "analytics school-api ला चिठ्ठी देऊ शकते, फक्त seat 3000" आणि "फाटक (ingress/ALB) दोन्ही apps ना चिठ्ठी देऊ शकते". संपले. आता compromised pod पोहोचू शकतो… नेमके काहीच जास्तीचे नाही.

एक प्रामाणिक अट: नियम तेव्हाच चालतात जेव्हा शाळेने ते वाचणारी शिक्षिका नेमलेली असते — CNI ने NetworkPolicy support केलीच पाहिजे. Minikube: --cni=calico ने सुरू करा (किंवा enable करा). EKS: VPC CNI मध्ये network-policy switch आहे (किंवा Calico install करा). अंमलबजावणी करणारा नाही = नियम शांतपणे दुर्लक्षित — नेहमी test करा!

🗺️ आकृती

flowchart LR
    subgraph before["😳 default: everyone whispers"]
        a1["🪑 any pod"] ---|"any note"| b1["🪑 any pod"]
    end
    subgraph after["🚫📝 with policies"]
        deny["1 default-deny:<br/>no notes at all"]
        allow1["2 allow: analytics → api :3000"]
        allow2["3 allow: gate → apps :3000/:8000"]
        blocked["❌ anything else: dropped"]
    end
    before -->|"apply k8s/network-policies.yaml"| after

❓ काय

NetworkPolicy pods निवडते (podSelector) आणि pod labels, namespace labels, किंवा CIDR नुसार — ports सह — ingress (त्यांच्याशी कोण बोलू शकते) आणि/किंवा egress (ते कोणाशी बोलू शकतात) यांची whitelist करते.
Policies म्हणजे एकमेकांत भर घालणाऱ्या allow-lists: deny rules नाहीत; जुळणाऱ्या सगळ्या policies चा union लागू होतो. न निवडलेले pods पूर्ण उघडे राहतात.
नेहमीची पाककृती (अगदी आपली file): namespace साठी एक default-deny-ingress, मग प्रत्येक योग्य संभाषणासाठी एक छोटी allow.
egress rules लिहिताना DNS egress (UDP 53) विसरू नका — "माझ्या policies मुळे सगळे बिघडले" ही क्लासिक चूक.

🤔 का

Defense in depth: security groups (AWS L10) इमारतीचे रक्षण करतात, RBAC (L17) API चे रक्षण करते, NetworkPolicies pod-to-pod चे रक्षण करतात. हा "attacker ला एक pod मिळाला" आणि "attacker ला एक pod मिळाला आणि मग database" यांतला फरक आहे. Auditors हे नावानिशी मागतात.

🧪 करून पाहा (policy लागू करणाऱ्या CNI सह cluster)

# before: anyone can reach the api — even a random debug pod:
kubectl -n school run spy --rm -it --image=curlimages/curl --restart=Never \
  -- curl -s -m 3 http://school-api && echo "😳 wide open"

# post the rules:
kubectl apply -f k8s/network-policies.yaml

# the spy is now blocked...
kubectl -n school run spy --rm -it --image=curlimages/curl --restart=Never \
  -- curl -s -m 3 http://school-api || echo "🚫 note intercepted!"

# ...but the real conversation still works (analytics wears the right label):
kubectl -n school exec deploy/school-analytics -- \
  python -c "import urllib.request;print(urllib.request.urlopen('http://school-api',timeout=3).status)"
# → 200 🎉  (if this ALSO fails: your CNI isn't enforcing — see the catch above)

🔧 या धड्यासाठी kubectl

kubectl get networkpolicy · kubectl exec spy -- curl …

🔗 यावर आधारित: 🪪 AWS L10 (security groups) · L21 (NACLs)

✅ तपासा — तुम्हाला काय दिसले पाहिजे

default-deny नंतर spy pod चा DB कडचा curl time out होतो; analytics → api call अजूनही चालतो.

🧹 साफसफाई

kubectl delete networkpolicy … — किंवा त्या ठेवा, त्याच तर मुद्दा आहेत

⚠️ नेहमीच्या चुका

policies लागू न करणाऱ्या CNI वरच्या policies — शांतपणे दुर्लक्षित, नेहमी test करा
default-deny मध्ये DNS egress विसरणे (सगळे एकदम 'बिघडते')

⏭️ पुढे

कोणते pods कोणत्या बाकांवर बसू शकतात — राखीव जागा, allergy टेबल, आणि शिक्षिकेची खुर्ची: taints, tolerations आणि affinity.

git checkout lesson-20-taints-affinity

🚫📝 Lesson 19 — NetworkPolicies: passing-notes rules

📍 You are here: Lesson 19 of 26 · Previous: lesson-18-jobs-cronjobs · Next: lesson-20-taints-affinity

📦 What's in this branch

Everything before, plus locking down who may talk to whom inside the cluster. Real file:

k8s/network-policies.yaml — default-deny + the two allowances our app actually needs

🧒 Explain like I'm 5

Surprise: in a fresh cluster, every pod can whisper to every pod 😳 — any kid can pass a note to any other kid, in any classroom, including straight to the grade book. One compromised pod = free tour of the whole school. (Security groups guard the desks from outside; nobody's been watching the notes inside.)

NetworkPolicies are the passing-notes rules:

First rule posted: "no notes at all in this classroom" (default-deny — an empty-selector policy that selects every pod). The moment ANY policy selects a pod, that pod stops accepting anything not explicitly allowed.
Then, allow exactly the notes the class needs: "analytics may pass notes to school-api, seat 3000 only" and "the gate (ingress/ALB) may pass notes to both apps". Done. A compromised pod can now reach… precisely nothing extra.

One honest catch: rules only work if the school hired a teacher who reads them — the CNI must support NetworkPolicy. Minikube: start with --cni=calico (or enable it). EKS: VPC CNI has a network-policy switch (or install Calico). No enforcer = rules silently ignored — always test!

🗺️ Diagram

flowchart LR
    subgraph before["😳 default: everyone whispers"]
        a1["🪑 any pod"] ---|"any note"| b1["🪑 any pod"]
    end
    subgraph after["🚫📝 with policies"]
        deny["1 default-deny:<br/>no notes at all"]
        allow1["2 allow: analytics → api :3000"]
        allow2["3 allow: gate → apps :3000/:8000"]
        blocked["❌ anything else: dropped"]
    end
    before -->|"apply k8s/network-policies.yaml"| after

❓ What

A NetworkPolicy selects pods (podSelector) and whitelists ingress (who may talk TO them) and/or egress (who they may talk to), by pod labels, namespace labels, or CIDR — plus ports.
Policies are additive allow-lists: no deny rules; union of all matching policies applies. Unselected pods stay wide open.
The standard recipe (exactly our file): a default-deny-ingress for the namespace, then one small allow per legitimate conversation.
Don't forget DNS egress when you write egress rules (UDP 53) — the classic "my policies broke everything" mistake.

🤔 Why

Defense in depth: security groups (AWS L10) guard the building, RBAC (L17) guards the API, NetworkPolicies guard pod-to-pod. It's the difference between "attacker got one pod" and "attacker got one pod and then the database". Auditors ask for this by name.

🧪 Try it (cluster with a policy-enforcing CNI)

# before: anyone can reach the api — even a random debug pod:
kubectl -n school run spy --rm -it --image=curlimages/curl --restart=Never \
  -- curl -s -m 3 http://school-api && echo "😳 wide open"

# post the rules:
kubectl apply -f k8s/network-policies.yaml

# the spy is now blocked...
kubectl -n school run spy --rm -it --image=curlimages/curl --restart=Never \
  -- curl -s -m 3 http://school-api || echo "🚫 note intercepted!"

# ...but the real conversation still works (analytics wears the right label):
kubectl -n school exec deploy/school-analytics -- \
  python -c "import urllib.request;print(urllib.request.urlopen('http://school-api',timeout=3).status)"
# → 200 🎉  (if this ALSO fails: your CNI isn't enforcing — see the catch above)

🔧 kubectl for this lesson

kubectl get networkpolicy · kubectl exec spy -- curl …

🔗 Builds on: 🪪 AWS L10 (security groups) · L21 (NACLs)

✅ Verify — what you should see

the spy pod's curl to the DB times out after the default-deny; the analytics → api call still works.

🧹 Clean up

kubectl delete networkpolicy … — or keep them, they're the point

⚠️ Common mistakes

policies on a CNI that doesn't enforce them — silently ignored, always test
forgetting DNS egress in a default-deny (everything 'breaks' at once)

⏭️ Next

Which pods may sit at which desks — reserved seats, allergy tables, and the teacher's chair: taints, tolerations & affinity.

git checkout lesson-20-taints-affinity

← Previousjobs cronjobs Next →taints affinity

This page is the lesson's README from the lesson-19-network-policies branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.