Hello, How can we put default-deny ingress policy for particular namespace ? Sa . . .

Kubernetes-Slack Discussions
#21

Srinivas Padala:
Yeah, @Ansuman Roy, In this case if we have new namespace, We should update the policy to allow.

Instead of that, I’m wondering if there is any policy that directly deny the specific namespace.

For example, there are multiple namespaces like dev, qa, production and I don’t want to touch production namespace, So block it… ( The other namespaces may grow in future )

#22

Ansuman Roy:
network policy is an allow only resource, there is no deny

#23

Ansuman Roy:
if you dont mention it is deny by default

#24

Ansuman Roy:
another question is its risky to split dev and prod workloads in a single cluster, better to separate them in their own cluster

#25

Srinivas Padala:
Yeah…It’s not realistic example… but there is critical namespace that you want to protect… Anyhow… understood the things…
Thanks

#26

Ansuman Roy:
for your usecase, you should try istio, this would give deny

#27

Ansuman Roy:
https://istio.io/latest/docs/reference/config/security/authorization-policy/#:~:text=Istio%20Authorization%20Policy%20enables%20access,ALLOW%20actions%20for%20access%20control.

#28

Ansuman Roy:
restricted namespace should be protected by rbac and roles.

#29

Ansuman Roy:
followed by an access webhook that you can have OPA to validate

#30

Ansuman Roy:
thats a separate topic altogether

#31

Ansuman Roy:
all right got to go to bed now its almost 2am for me :slightly_smiling_face:

#32

Srinivas Padala:
Yeah, Got it Ansuman, Thanks. Have great sleep :slightly_smiling_face: