container.training/slides/exercises/netpol-details.md

Exercise — Network Policies

We want to implement a generic network security mechanism.

Instead of creating one policy per service, we want to create a fixed number of policies, and use a single label to indicate the security level of our pods.

Then, when adding a new service to the stack, instead of writing a new network policy for that service, we only need to add the right label to the pods of that service.

---

Specifications

We will use the label security to classify our pods.

• If security=private:

  the pod shouldn't accept any traffic

• If security=public:

  the pod should accept all traffic

• If security=namespace:

  the pod should only accept connections coming from the same namespace

If security isn't set, assume it's private.

---

Test setup

• Deploy a copy of the DockerCoins app in a new namespace

• Modify the pod templates so that:

  • webui has security=public

  • worker has security=private

  • hasher, redis, rng have security=namespace

---

Implement and test policies

• Write the network policies

  (feel free to draw inspiration from the ones we've seen so far)

• Check that:

  • you can connect to the webui from outside the cluster

  • the application works correctly (shows 3-4 hashes/second)

  • you cannot connect to the hasher, redis, rng services

  • you cannot connect or even ping the worker pods