Container Service for Kubernetes:Use network policies in ACK clusters

Console

1. Configure a Network Policy for the nginx Service. For configuration details, see Use case 1: Restrict Service access to applications with specific labels.

2. In the service list, find the public IP address of the nginx Service in the External Endpoint column (for example, 47.xxx.xx.x) and try to access the address in your browser.

   Access fails because the Network Policy denies all ingress traffic by default.

3. Modify the Network Policy to allow access from specific client CIDR blocks.

   1. Open myip.ipip.net in a browser to find the public IP address of your machine.

   2. In the Network Policy list, find the access-nginx policy, click Edit in the Actions column, and then modify the rules in the Edit panel.

      To the right of Source, click + Add and perform the following steps:

      • To the right of Rule, click + Add to add a rule that allows access from your machine's IP address:

        Parameter	Example
        Selector	ipBlock
        cidr	<Your machine's IP address>/32 For example, 42.xx.xx.xx/32

      • To the right of Rule, click + Add to add another rule that allows access from the Alibaba Cloud SLB health check CIDR block:

        Parameter	Example
        Selector	ipBlock
        cidr	100.0.0.0/8

      • To the right of Port, click + Add. Configure the port settings as follows:

        Parameter	Example
        Protocol	TCP
        Port	80

      

   3. Click Next, and then click OK.

   4. In the service list, click the IP address in the External Endpoint column (for example, 47.xxx.xx.x:80) to access the nginx Service.

      

      After the Network Policy is updated, you can access the nginx Service from your client through the Internet-facing SLB.

CLI

1. Run the following command to create an Alibaba Cloud Server Load Balancer (SLB) service for the nginx application, specifying type=LoadBalancer to expose the nginx service to the internet.

   vim nginx-service.yaml

   The following is the template for the nginx-service.yaml file.

   # Paste the following YAML content into nginx-service.yaml.
   apiVersion: v1
   kind: Service
   metadata:
     labels:
       run: nginx
     name: nginx-slb
   spec:
     externalTrafficPolicy: Local
     ports:
     - port: 80
       protocol: TCP
       targetPort: 80
     selector:
       run: nginx
     type: LoadBalancer

   Run the following command to create the Service from the nginx-service.yaml file.

   kubectl apply -f nginx-service.yaml 

   Expected output:

   service/nginx-slb created

   Verify that the Service is exposed to the internet:

   kubectl get service nginx-slb

   Expected output:

   NAME        TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)        AGE
   nginx-slb   LoadBalancer   172.19.xx.xxx   47.110.xxx.xxx   80:32240/TCP   8m

2. Run the following command to access the IP address of the SLB that you just created, 47.110.xxx.xxx. Access fails.

   wget 47.110.xxx.xxx

   Expected output:

   --2018-11-21 11:46:05--  http://47.110.xx.xxx/
   Connecting to 47.110.XX.XX:80... failed: Connection refused.

   Note

   Access fails for the following reasons:

   • The configured nginx Service can only be accessed by applications with the specific label access=true.

   • Accessing the IP address of an SLB provides external access to Kubernetes, which is different from using a network policy to restrict service access to only applications with specific labels.

   Solution: Modify the Network Policy to add allowed source CIDR blocks.

3. Run the following command to check your local public IP address.

   curl myip.ipip.net

   Expected output:

   Current IP: 10.0.x.x From: China Beijing Beijing        # The output is for reference only. Use your actual IP address.

4. Run the following command to modify the policy.yaml file.

   vim policy.yaml

   Update the policy.yaml file with the following content:

   # The following is the content of the YAML file.
   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: access-nginx
   spec:
     podSelector:
       matchLabels:
         run: nginx
     ingress:
     - from:
       - podSelector:
           matchLabels:
             access: "true"
       - ipBlock:
           cidr: 100.64.0.0/10
       - ipBlock:
           cidr: 10.0.0.0/24      # The address range of your local network. This is an example. Use your actual information.

   Run the following command to apply the changes from the policy.yaml file.

   kubectl apply -f policy.yaml 

   Expected output:

   networkpolicy.networking.k8s.io/access-nginx unchanged

   Note

   • Use a /24 address range.

   • The SLB health check address is in the 100.64.0.0/10 address block. Therefore, you must configure 100.64.0.0/10.

5. Start a client Pod and use it to access the nginx Service.

   kubectl run busybox --rm -ti --labels="access=true" --image=busybox /bin/sh

   Access the nginx Service:

   wget 47.110.XX.XX

   Expected output:

   Connecting to 47.110.XX.XX (47.110.XX.XX:80)
   index.html           100% |***********************************************************|   612  0:00:00 ETA

   A 100% progress indicates a successful connection to the nginx Service.

Console

This topic uses an example with the domains www.aliyun.com and registry.aliyuncs.com to demonstrate how to configure a network policy that allows a Pod to access only registry.aliyuncs.com.

1. Use the ping command to query registry.aliyuncs.com for its bound IP address (120.55.XXX.XXX).

2. Create a rule in the network policy to restrict the busybox application's access to only registry.aliyuncs.com.

   1. On the Network Policies page, click Create in the upper-right corner. In the Create panel, configure the Network Policy rules.

   For more information about the parameters, see Use case 1: Restrict Service access to applications with specific labels. The following table shows the example configuration.

   Parameter	Description	Example
   Name	A custom name for the Network Policy.	busybox-policy
   Pod Selectors	Click + Specify workload type and labels to select the Pods to which the Network Policy applies. Note If you do not specify a Pod Selector, the Network Policy applies to all Pods in the Namespace.	This example uses the following settings: Set Type to Stateless. Set Workloads to busybox. Set Labels to app=busybox.
   Egress	To the right of Egress, click + Add, and then to the right of Rule, click + Add. Add a rule where the ipBlock is the IP address that you previously obtained for registry.aliyuncs.com in the /32 format, such as 120.55.XXX.XXX/32.	Selector: ipBlock cidr: 120.55.XXX.XXX/32
   	To the right of Egress, click + Add to add another rule. This rule allows egress traffic on UDP Port 53 to all Namespaces, which allows the application to perform DNS Resolution. To the right of Rule, click + Add and add a rule that selects all Namespaces. To the right of Port, click + Add and add a rule for UDP Port 53.	Rule: Selector: namespaceSelector Namespace: All Port: Protocol: UDP Port: 53

   2. Click Next, and then click OK.

   3. In the BusyBox terminal, run the following command to access www.aliyun.com.

      nc -vz -w 1 www.aliyun.com 443

      Expected output:

      nc: www.aliyun.com (60.191.xx.xx:443): Connection timed out

      Access registry.aliyuncs.com.

      nc -vz -w 1 registry.aliyuncs.com 443

      Expected output:

      registry.aliyuncs.com (120.55.xx.xx:443) open

CLI

1. Run the following command to obtain the list of IP addresses that www.aliyun.com resolves to.

   dig +short registry.aliyuncs.com

   Expected output:

   120.55.XXX.XXX

2. Run the following command to create the busybox-policy file.

   vim busybox-policy.yaml

   The busybox-policy file template is as follows:

   # The following is the content of the YAML file.
   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: busybox-policy
   spec:
     podSelector:
       matchLabels:
         run: busybox
     egress:
     - to:
       - ipBlock:
           cidr: 120.55.XXX.XXX/32
     - to:
       - ipBlock:
           cidr: 0.0.0.0/0
       - namespaceSelector: {}
       ports:
       - protocol: UDP
         port: 53

   Note

   The busybox-policy file contains an Egress Rule that restricts the application's outbound access. You must configure this rule to allow UDP requests. Otherwise, DNS resolution will fail.

3. Run the following command to create a network policy from the busybox-policy file.

   kubectl apply -f busybox-policy.yaml 

   Expected output:

   networkpolicy.networking.k8s.io/busybox-policy created

4. Run the following command to start a busybox Pod and test network access.

   kubectl run busybox --rm -ti --image=busybox /bin/sh

   Access websites other than www.aliyun.com, for example, www.taobao.com:

   wget www.taobao.com

   Expected output:

   Connecting to www.taobao.com (64.13.XX.XX:80)
   wget: can't connect to remote host (64.13.XX.XX): Connection timed out

   The can't connect to remote host error indicates that access to the service failed.

5. Run the following command to access www.aliyun.com.

   wget registry.aliyuncs.com

   Expected output:

   Connecting to registry.aliyuncs.com (120.55.XXX.XXX:80)
   Connecting to registry.aliyuncs.com (120.55.XXX.XXX:443)
   wget: note: TLS certificate validation not implemented
   index.html           100% |***********************************************************|  462k  0:00:00 ETA

   The 100% progress indicates a successful connection.

Console

1. In the upper-right corner of the Network Policies page, click Create. In the Create panel, configure the Network Policy.

   For parameter details and steps, see Restrict Service access to applications with specific labels using a Network Policy. The following table shows the example configuration.

   Parameter	Value
   Name	deny-public-net
   Pod Selector	Set Type to All.
   Ingress	Add the following two rules: An allow-all rule for namespaceSelector. An allow-all rule for ipBlock.
   Egress	Add a rule that allows egress traffic only to private networks: Set namespaceSelector to All to allow Pods to access all Pods in the internal network. Create three rules for ipBlock to allow egress traffic to the following three private network CIDR blocks: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Note You cannot add multiple CIDR blocks in a single ipBlock rule.

2. Click Next, and then click OK.

3. On the Basic Information tab of the cluster details page, obtain the internal IP address and port.

   

4. In the busybox terminal, run the following commands to test the Pod's public and private network access.

   nc -vz -w 1 www.aliyun.com 443

   Expected Output: The Pod cannot access the public network, and the connection times out.

   nc: www.aliyun.com (60.191.xx.xx:443): Connection timed out

   Test private network access.

   nc -vz -w 1 10.134.xx.xx:<Port> # Replace with your private IP address.

   Expected Output: The Pod can access the private network address.

   10.134.xx.xx:<Port> (10.134.xx.xx:<Port>) open

CLI

1. Run the following command to create a test namespace to verify the access restrictions.

   Create a namespace named test-np.

   kubectl create ns test-np

   Expected output:

   namespace/test-np created

2. Create a default Network Policy for this namespace that allows egress traffic only to private networks.

   vim default-deny.yaml

   The following is an example template for the default-deny.yaml file:

   # The following is the content of the YAML file.
   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     namespace: test-np
     name: deny-public-net
   spec:
     podSelector: {}
     ingress:
     - from:
       - ipBlock:
           cidr: 0.0.0.0/0
     egress:
     - to:
       - ipBlock:
           cidr: 192.168.0.0/16
       - ipBlock:
           cidr: 172.16.0.0/12
       - ipBlock:
           cidr: 10.0.0.0/8

   Run the kubectl apply command to create the Network Policy from the default-deny.yaml file.

   kubectl apply -f default-deny.yaml

   Expected output:

   networkpolicy.networking.k8s.io/deny-public-net created

   View the Network Policy:

   kubectl get networkpolicy -n test-np

   Expected output:

   NAME                              POD-SELECTOR          AGE
   deny-public-net                   <none>                1m

3. Create a Network Policy that allows Pods with a specific label to access the public network.

   vim allow-specify-label.yaml

   The example label is set to public-network=true.

   # The following is the content of the YAML file.
   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: allow-public-network-for-labels
     namespace: test-np
   spec:
     podSelector:
       matchLabels:
         public-network: "true"
     ingress:
     - from:
       - ipBlock:
           cidr: 0.0.0.0/0
     egress:
     - to:
       - ipBlock:
           cidr: 0.0.0.0/0
       - namespaceSelector:
           matchLabels:
             ns: kube-system  # Allows Pods to access key services in kube-system, such as CoreDNS. This is an example. Configure as needed. 

   Run the following command to create the Network Policy:

   kubectl apply -f allow-specify-label.yaml

   Expected output:

   networkpolicy.networking.k8s.io/allow-public-network-for-labels created

   View the Network Policy:

   kubectl get networkpolicy -n test-np

   Expected output:

   NAME                              POD-SELECTOR          AGE
   allow-public-network-for-labels   public-network=true    1m
   deny-public-net                   <none>                 3m

4. Run the following commands to verify that a Pod without the special label cannot access the public network.

   kubectl run -it --namespace test-np --rm --image registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/busybox:1.28 busybox-intranet

   ping aliyun.com

   Expected output:

   PING aliyun.com (106.11.2xx.xxx): 56 data bytes
   ^C
   --- aliyun.com ping statistics ---
   9 packets transmitted, 0 packets received, 100% packet loss

   If 0 packets received is displayed, the access failed.

   Note

   The access failure is caused by the deny-public-net network policy rule. This rule denies default public network access for Pods in the test-np namespace. As a result, Pods that have default labels and are launched in this namespace cannot access the public network.

5. Run the following command to verify that a Pod with public-network=true can access the Service.

   kubectl run -it --namespace test-np --labels public-network=true --rm --image registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/busybox:1.28 busybox-internet

   ping aliyun.com

   Expected output:

   PING aliyun.com (106.11.1xx.xx): 56 data bytes
   64 bytes from 106.11.1xx.xx: seq=0 ttl=47 time=4.235 ms
   64 bytes from 106.11.1xx.xx: seq=1 ttl=47 time=4.200 ms
   64 bytes from 106.11.1xx.xx: seq=2 ttl=47 time=4.182 ms
   ^C
   --- aliyun.com ping statistics ---
   3 packets transmitted, 3 packets received, 0% packet loss
   round-trip min/avg/max = 4.182/4.205/4.235 ms

   When 0% packet loss is displayed, you have successfully accessed the service.

   Note

   The busybox-internet Pod can access the public network because the allow-public-network-for-labels network policy contains a rule that allows public network access for Pods with the public-network=true label.