Hello. I have a question about official documentation. For me network policies o . . .

Kubernetes-Slack Discussions
#1

Genko:
Hello. I have a question about official documentation. For me network policies only work if I put dash before -to AND before -ports, is it typo in documentation or some special case?

Screenshot 2023-09-25 at 15.58.13.png
Screenshot 2023-09-25 at 15.58.13.png893×809 49.1 KB

#2

Aswin Venkat:
@Genko you need to understand the YAML.
in the above image , it can be

- to
  ports

or

- ports
  to

they both are under same object , so either ports or to should start with - symbol. the same for from object.

#3

Genko:
@Aswin Venkat you didn’t get it, I know yaml and that this is an object. Look at this solution from Killerkoda

Screenshot 2023-09-25 at 15.56.39.png
Screenshot 2023-09-25 at 15.56.39.png554×801 57.4 KB

#4

Aswin Venkat:
@Genko the solution is correct only , there is necessary that the object should contain both the ports and to attribute.

So there are 2 different options objects in the picture. First one doesn’t contain to , only ports , which means the port is opened to all (no restriction)

#5

Genko:
look at the doc reference describing NetworkPolicies https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/network-policy-v1/

#6

Aswin Venkat:
@Genko port 53 is open to all , that’s why there is no “to” mentioned

#7

Genko:
it MUST have dash according to official reference on original picture before -ports

#8

Genko:
there’s NO *egress.*to.ports

#9

Genko:
only egress.ports or http://egress.to|egress.to check it out in the link above

#10

Aswin Venkat:
@Genko the solution in the picture is correct as per my knowledge.

The first object allows all egress to 53 port.

The second object will restrict all egress to space2 namespace.
It gives correct answer to the question that is asked.

#11

Genko:
@Aswin Venkat ofcourse its correct, I have showed you correct one to compare with original one

#12

Genko:
there are two types of rules possible NetworkPolicyPeer or NetworkPolicyPort, and on this image the yaml is incorrect https://kodekloud.slack.com/archives/CHMV3P9NV/p1695650574999779

#13

Alistair Mackay:

➜  ~ k explain netpol.spec.ingress
KIND:     NetworkPolicy
VERSION:  <http://networking.k8s.io/v1|networking.k8s.io/v1>

RESOURCE: ingress &lt;[]Object&gt;

DESCRIPTION:
     List of ingress rules to be applied to the selected pods. Traffic is
     allowed to a pod if there are no NetworkPolicies selecting the pod (and
     cluster policy otherwise allows the traffic), OR if the traffic source is
     the pod's local node, OR if the traffic matches at least one ingress rule
     across all of the NetworkPolicy objects whose podSelector matches the pod.
     If this field is empty then this NetworkPolicy does not allow any traffic
     (and serves solely to ensure that the pods it selects are isolated by
     default)

     NetworkPolicyIngressRule describes a particular set of traffic that is
     allowed to the pods matched by a NetworkPolicySpec's podSelector. The
     traffic must match both ports and from.

FIELDS:
   from &lt;[]Object&gt;
     List of sources which should be able to access the pods selected for this
     rule. Items in this list are combined using a logical OR operation. If this
     field is empty or missing, this rule matches all sources (traffic not
     restricted by source). If this field is present and contains at least one
     item, this rule allows traffic only if the traffic matches at least one
     item in the from list.

   ports        &lt;[]Object&gt;
     List of ports which should be made accessible on the pods selected for this
     rule. Each item in this list is combined using a logical OR. If this field
     is empty or missing, this rule matches all ports (traffic not restricted by
     port). If this field is present and contains at least one item, then this
     rule allows traffic only if the traffic matches at least one port in the
     list.

What this tells us that below

spec:
  ingress:

follows a list of object. The structure of the ingress object is two fields from and ports. Both are optional, meaning that each rule in the list beginning with - may have either ports only, from only or both. If both are present, the order is not significant…

Egress works similarly, but the rule object has to field instead of from

#14

Genko:
Ok so we have list of NetworkPolicyIngressRule rules, each of them may have both or one of two keys -ports or -from/to. On the first picture it has object with both keys from/ports for ingress and to/ports for egress. On second picture it has two rules with one key -ports and one key -to

#15

Genko:
so and -ports key applies for all selected pods in namespaces or for -from/to key

#16

Alistair Mackay:
ports applies to what is selected by the rule. With no from or to it is a rule that applies to everything the policy is attached to. This is why the DNS egress policy only has ports - it allows egress only on the DNS ports, but to anywhere.

#17

Alistair Mackay:
Remember also that a network policy applies to PODS, those pods being matched by the initial podSelector that is not part of the rules. Network polices are simple firewalls for pods, not namespaces or subnets. They govern what goes into and out of the pods to which it applies

#18

Alistair Mackay:
The concept of netpols seems the most difficult thing to grasp for nearly everyone, but once you understand them properly they do make sense.

#19

Alistair Mackay:
Recommended: https://kodekloud.com/courses/learn-by-doing-kubernetes-network-policies/

#20

Genko:
@Alistair Mackay thanks