Network Policy in Kubernetes
Tags: kubernetes, devsecops, cilium
Published: 2024-06-02 08:17:13

Secure communication between pods is critical in maintaining secure deployments. In this post, I will demonstrate how Kubernetes Network Policy can enforce fine-grained security controls in Kubernetes.

I will demonstrate how to set up and enforce network policies in a Minikube environment, ensuring a MYSQL pod in one namespace cannot be accessed by a client pod in another namespace after applying the policy.


## Prerequisites
- A working installation of Minikube
- Basic Knowledge of Kubernetes concepts and resources
- '_kubectl_' configured to interact with the Minikube cluster.

### Start Minikube
setup the Kubernetes environment with Minikube
`minikube start`
![Start Minikube](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bp5gnim09cy6z54s41a7.png)

### Create Namespaces and Deploy Pods
Create two namespaces: _database_ namespace; for the MySQL pod and _client_ namespace; for the client pod connecting to the MYSQL Database.

### Deploy a MYSQL pod in the 'database' namespace:

```
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: mysql
  namespace: database
  labels:
    app: mysql
spec:
  containers:
  - name: mysql
    image: mysql:5.7
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: password
EOF
```

### Deploy a Client pod in the  `client` namespace:

```
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: client
  labels:
    app: client
spec:
  containers:
  - name: client
    image: mysql:5.7
    command: ["sleep", "3600"]
EOF
```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ac6mgjywvf245ozgx5gr.png)

## Test Connectivity Before Apply Network Policy
Verify that the client pod can connect to the MYSQL pod:
`kubectl exec -it client -n client -- sh`

Connect to MySQL:
`mysql -h <pod ip address> -u root -p`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b7fn0dkofmda45l79aig.png)

## Implementing Kubernetes Network Policy
Now, we can create a Kubernetes Network Policy to deny access from the `client` namespace to the `database` namespace.

I prefer using the [Cilium Kubernetes Network Policy Generator](https://cilium.io/blog/2021/02/10/network-policy-editor/). This tool provides a user-friendly UI to interpret policies at a glance and create them in a few clicks. It can be used to develop [Kubernetes Network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) and [Cilium Network Policy](https://editor.cilium.io/)

Cilium offers a more robust and feature-rich alternative to Kubernetes' built-in network policies, enabling advanced security features like deep packet inspection and layer 7 (Application Layer) policies.

### Generate a Kubernetes Network Policy with Cilium Policy Generator
[How to use the UI policy Generator](https://share.zight.com/yAuzDN9x)
```
kubectl --apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-client-access
  namespace: database
spec:
  podSelector:
    matchLabels:
      app: mysql
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress: []
EOF
```

## Test Connectivity After Applying Network Policy
Verify that the client pod can no longer connect to the MySQL pod:
`kubectl exec -it -n client -- sh`
`mysql -h <pod ip address> -u root -p`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ut39ja442vqjqmpkkn96.png)

By implementing Kubernetes Network Policies, we can effectively control the communication between pods across namespaces, enhancing the security of our Kubernetes cluster. For more advanced and robust network policies, technologies like cilium can be used.