I am trying to implement Network Policies in my test Azure Kubernetes cluster, but I cannot get them to work. I have two namespaces - default and nginx (and others as well, but they shouldn't be affecting the NP).
I have an nginx deployment in each ns that displays a webpage with some text on '/'. (I have modified the pages slightly so I can recognize which one I'm hitting). I also have a ClusterIP service for each deployment. I deployed a Deny All Network Policy in the nginx namespace that targets all pods inside. However, when I open a shell inside the nginx pod in the default namespace and I do a curl http://servicename.namespace.svc:serviceport (which resolves to the service inside the nginx namespace) I can access the pod despite the Network Policy rule.
Here are my manifests:
- nginx in the nginx namespace:
apiVersion: apps/v1
kind: Deployment
metadata:
name: svet-nginx-deployment
namespace: nginx
spec:
selector:
matchLabels:
app: nginx
replicas: 1
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: <azurecr>/samples/nginx
ports:
- containerPort: 80
volumeMounts:
- name: config-volume
mountPath: /usr/share/nginx/html
volumes:
- name: config-volume
configMap:
name: svet-config
- ClusterIP service in the nginx namespace:
apiVersion: v1
kind: Service
metadata:
name: ingress2
namespace: nginx
spec:
selector:
app: nginx
ports:
- protocol: TCP
port: 80
targetPort: 80
- Network Policy in the nginx namespace
I got this one from github, but I also tested with Default deny all ingress traffic from the official kubernetes documentation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-ingress
namespace: nginx
spec:
podSelector: {}
policyTypes:
- Ingress
ingress: []
- nginx in the default namespace:
apiVersion: apps/v1
kind: Deployment
metadata:
name: svet-nginx-deployment
namespace: default
spec:
selector:
matchLabels:
app: nginx
replicas: 1
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: <azurecr>.azurecr.io/samples/nginx
ports:
- containerPort: 80
volumeMounts:
- name: config-volume
mountPath: /usr/share/nginx/html
volumes:
- name: config-volume
configMap:
name: svet-config
- ClusterIP service in the default namespace:
apiVersion: v1
kind: Service
metadata:
name: ingress1
namespace: default
spec:
selector:
app: nginx
ports:
- protocol: TCP
port: 80
targetPort: 80
Please ignore the bad naming - this is only a training environment
I have tried many different iterations of the Network Policy starting with more complex and moving to the simplest denyall policy that I have pasted, but nothing seems to be working. I have enabled Azure CNI as required.
Am I missing something?
