Welcome to nginx!

--- title: "Kubernetes policy, advanced tutorial" description: "Step-by-step tutorial for writing advanced Kubernetes network policies in Calico Cloud, including namespace-scoped rules and default deny for ingress and egress." product: "Calico Cloud" version: "v23.0.1" section: "Tutorials" canonical_url: "https://docs.tigera.io/calico-cloud/tutorials/kubernetes-tutorials/kubernetes-policy-advanced" --- # Kubernetes policy, advanced tutorial The Kubernetes `NetworkPolicy` API allows users to express ingress and egress policies (starting with Kubernetes 1.8.0) to Kubernetes pods based on labels and ports. This guide describes how to use Kubernetes `NetworkPolicy` to define more complex network policies. ## Requirements - A working Kubernetes cluster and access to it using kubectl - Your Kubernetes nodes have connectivity to the public internet - You are familiar with [Kubernetes NetworkPolicy](https://docs.tigera.io/calico-cloud/tutorials/kubernetes-tutorials/kubernetes-policy-basic.md) ## Tutorial flow 1. Create the Namespace and Nginx Service 2. Deny all ingress traffic 3. Allow ingress traffic to Nginx 4. Deny all egress traffic 5. Allow egress traffic to kube-dns 6. Cleanup Namespace ## 1. Create the namespace and nginx service We'll use a new namespace for this guide. Run the following commands to create it and a plain nginx service listening on port 80. ```bash kubectl create ns advanced-policy-demo kubectl create deployment --namespace=advanced-policy-demo nginx --image=nginx kubectl expose --namespace=advanced-policy-demo deployment nginx --port=80 ``` ### Verify access - allowed all ingress and egress Open up a second shell session which has `kubectl` connectivity to the Kubernetes cluster and create a busybox pod to test policy access. This pod will be used throughout this tutorial to test policy access. ```bash kubectl run --namespace=advanced-policy-demo access --rm -ti --image busybox /bin/sh ``` This should open up a shell session inside the `access` pod, as shown below. ```text Waiting for pod advanced-policy-demo/access-472357175-y0m47 to be running, status is Pending, pod ready: false If you don't see a command prompt, try pressing enter. / # ``` Now from within the busybox "access" pod execute the following command to test access to the nginx service. ```bash wget -q --timeout=5 nginx -O - ``` It should return the HTML of the nginx welcome page. Still within the busybox "access" pod, issue the following command to test access to google.com. ```bash wget -q --timeout=5 google.com -O - ``` It should return the HTML of the google.com home page. ## 2. Deny all ingress traffic Enable ingress isolation on the namespace by deploying a [default deny all ingress traffic policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic). ```bash kubectl create -f - < Welcome to nginx!... ``` After creating the policy, we can now access the nginx Service. ## 4. Deny all egress traffic Enable egress isolation on the namespace by deploying a [default deny all egress traffic policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-egress-traffic). ```bash kubectl create -f - < **SECONDARY:** The `nslookup` command can take a minute or more to timeout. ## 5. Allow DNS egress traffic Run the following to create a label of `name: kube-system` on the `kube-system` namespace and a `NetworkPolicy` which allows DNS egress traffic from any pods in the `advanced-policy-demo` namespace to the `kube-system` namespace. ```bash kubectl label namespace kube-system name=kube-system kubectl create -f - < Welcome to nginx!... ``` Next, try to retrieve the home page of google.com. ```bash wget -q --timeout=5 google.com -O - ``` It should return: ```text wget: download timed out ``` Access to `google.com` times out because it can resolve DNS but has no egress access to anything other than pods with labels matching `app: nginx` in the `advanced-policy-demo` namespace. # 7. Clean up namespace You can clean up after this tutorial by deleting the advanced policy demo namespace. ```bash kubectl delete ns advanced-policy-demo ```