Kubernetes Network Policies Explained

  Рет қаралды 14,965

DevOps Toolkit

DevOps Toolkit

Күн бұрын

Пікірлер: 49
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
Are you applying Kubernetes Network Policies?
@salihamallem
@salihamallem Жыл бұрын
Yes sir
@morzatt
@morzatt 2 ай бұрын
This is still one of the BEST explanations I've heard EVER!
@akk2766
@akk2766 10 ай бұрын
Thank you, thank you, thank you!!! This video is GOLD! The main treasure discovered at 8:32
@josefromspace
@josefromspace Жыл бұрын
Great explanation, great communicating skills. This video is just great, it shows how things should be explained, first presents the problem in a clear and relatable manner and then presents the solution in clear technical terms. Subscribed.
@hide7890
@hide7890 Жыл бұрын
This video is amazing! I love the examples
@enzanto
@enzanto 6 ай бұрын
Dang, always struggled with getting this in my head.. Until i saw this video!
@johndangelo9630
@johndangelo9630 Жыл бұрын
Loved it! GREAT JOB!!
@bbstriker
@bbstriker 11 ай бұрын
This is great, but if you segment applications and DBs at infrastructure level layer 3, you can use NACLs and NSGs to ensure that the DB only ever accepts connections from a specific IP segment and port number. Products like Cillium are great provided you have an underlay of L3/L4 segments ( that we can call 'macro-segementation') governed by firewalls applying ingress and egress policies. These policies should not be accessible by developers. As long as microServices are architected to perform web, middleware, business logic and DB roles, you can segement. Cillium can be used as a microsegnentation over a macro-segmented environment. Developers can then be given freedom to microsegment using Ciliium. This approach provides governance, delivers separation of duties and provides a level assurance over misconfiguration errors.
@josephrajareddy4606
@josephrajareddy4606 3 ай бұрын
You got a new subscriber today!
@김도형-g2i
@김도형-g2i 10 ай бұрын
great tip you gave that the namespaceSelector to be set to kube-system for ingress controller!
@swapnilshingote8773
@swapnilshingote8773 Жыл бұрын
My god the much awaited video is here....❤
@pranaysinghparihar4738
@pranaysinghparihar4738 5 ай бұрын
This was amazing
@KnThSelf2ThSelfBTrue
@KnThSelf2ThSelfBTrue Жыл бұрын
I'm okay with "Connection Refused! Why? You figure it out!" alongside extremely clear boundaries where we everyone can be absolutely certain there is no reason to hop across, accompanied by other means of identifying what's going on if for some reason someone didn't get the memo. Otherwise, I want it to be easy to diagnose the problem and solve it the right way. This can be solved with great docs or visualization tools, or clear error messages closer to the application layer. Hasty, over-permissive solutions often emerge from frustrated devs. That's what scares me a little about Network Policies, but I do think they have their use-cases. One really good use-case for this, I think, is multi-tenancy.
@SumanChakraborty0
@SumanChakraborty0 Жыл бұрын
Thanks for the great explanation!! What would be a better offering in terms of applying network policies - Managed Network policy (e g Calico Enterprise) or an open source version implementation?
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
I rarely used enterprise version of an open source networking solution so I'm not sure what the differences are.
@TitusCornelius
@TitusCornelius Жыл бұрын
thanks for your amazing videos, you're really great! What are you using for creating your diagrams, they're so nice!
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
I have an agency that does editing, animations, audio, etc.
@salihamallem
@salihamallem Жыл бұрын
Google is working on separate branch where they provide NP with hostname restriction capabilities, layer 7 🎉
@diegonayalazo
@diegonayalazo Жыл бұрын
Thanks ❤
@mateuszlachowski5282
@mateuszlachowski5282 Жыл бұрын
Hi Viktor i would love see video about Paralus or diffrent centralized platform to manage multiple clusters with zero trust concept.
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
Adding it to my to-do list....
@ibrahimmohammed3386
@ibrahimmohammed3386 9 ай бұрын
I am seeing traffic is blocked from external even after adding kube-system in ingress but when I add ipblock 0.0.0.0/0 it allows but it is opened for external and internal, how can i resolve it?
@DevOpsToolkit
@DevOpsToolkit 9 ай бұрын
It's hard for me to answer such a question without take a look at it first.
@me4jas
@me4jas 9 ай бұрын
Excellent video. Stupid question may be - Can you somehow select podselector to use IP addresses instead of labels ? Sorry I came from cisco NACL background :D
@DevOpsToolkit
@DevOpsToolkit 9 ай бұрын
If it's for internal communication (within a cluster), IPs would not help much since they are changing allí the time since pods are being created and destroyed all the time.
@me4jas
@me4jas 9 ай бұрын
@@DevOpsToolkit Make sense. Thanks !
@dimaj1
@dimaj1 Жыл бұрын
Thanks for the great video! I thought, altho haven't played with it myself yet, that OPA Gatekeeper could also be used to limit who can access what. Is there a reason to avoid managing network policies with OPA?
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
OPA is first and foremost about policies that verify whether resources are defined correctly rather than enforcing networking rules. You could do it though, but that would not be a good idea and would be very limiting.
@dimaj1
@dimaj1 Жыл бұрын
@@DevOpsToolkit Sounds good. Thank you!
@davids2540
@davids2540 4 ай бұрын
Sorry if I missed it in the video but my understanding is that by default pods can communicate with each other directly, whether you use a service or not
@DevOpsToolkit
@DevOpsToolkit 4 ай бұрын
They could talk to each other, just as anything else, by sending requests to the IP of the other. The problem is that pods would have a hard time discovering IPs and keeping them up to date. Services are, first and foremost, resources that do service discovery.
@junaidahmed9704
@junaidahmed9704 10 ай бұрын
can a pod access other pods without using services?
@DevOpsToolkit
@DevOpsToolkit 10 ай бұрын
Assuming that there are no additional protections, yes. A pod can access anything as long as it knows how to find it. It would need to know the IPs of those Pods or to go out and come back in through a DNS and a load balancer. There would have to be a very good reasons NOT to use Services.
@nbensa
@nbensa 6 ай бұрын
Am I the only one who cannot get the ingress rule to work with Cilium? Also Viktor, you missed the namespaces definition in the gist/repo. My guess is the namespaces have the label environment=production and environment=staging.
@DevOpsToolkit
@DevOpsToolkit 6 ай бұрын
Oh my. I did forget to push namespaces.yaml. Can you make a PR if you have them at hand? I haven't had problems making ingress work with cilium. It might be something else that's failing. We can do screen sharing session and take a look at it together. However, I'll be traveling for the most of June so it would have to be aonth from now 😔
@nbensa
@nbensa 6 ай бұрын
@@DevOpsToolkit Thanks for your reply! I just made the PR. As for the screensharing offer, I can wait. In fact it gives me time to try to debug the problem myself. But I must warn you. My spoken English is very weak :-)
@DevOpsToolkit
@DevOpsToolkit 6 ай бұрын
@nbensa no worries about your English. I don't speak it natively either. Send me a direct message on LinkedIn or Twitter and I'll get back to you with a calendar link. You can choose any time available there.
@AdamAlzein-p2f
@AdamAlzein-p2f Жыл бұрын
is there any SRE training from Zero to Hero ?
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
It's a long road that starts with Linux and a programming language of choose, continues towards Cloud and Kubernetes, and never ends.
@ppasouza
@ppasouza Жыл бұрын
--image alpine/curl ;)
@DevOpsToolkit
@DevOpsToolkit Жыл бұрын
True. Sometimes I make silly mistakes often caused by lazyness.
@ppasouza
@ppasouza Жыл бұрын
​@@DevOpsToolkit oh to me this is not even a mistake, sorry if it sounded like that. I'm studying for the CKA so I'm a bit crazy about saving time, it was automatic hehe ;P BTW, thank you for the great content you make!
@zenobikraweznick
@zenobikraweznick Жыл бұрын
Is there a way to apply such policies as egress to my wife ? 🙄
@prinson001
@prinson001 Жыл бұрын
@NomDayPloom
@NomDayPloom Жыл бұрын
...last? 😅
@JohnNguyen-x1w
@JohnNguyen-x1w 6 ай бұрын
Not get shut in your back? Is this English?
@DevOpsToolkit
@DevOpsToolkit 6 ай бұрын
English is not my mother tongue so it could be the case of me inventing a phrase thinking that it is used by others
@gouravchhabra6142
@gouravchhabra6142 Жыл бұрын
First ...😄
Secrets Made My Life Miserable - Consume Secrets Easily With Teller
13:48
Chain Game Strong ⛓️
00:21
Anwar Jibawi
Рет қаралды 39 МЛН
Леон киллер и Оля Полякова 😹
00:42
Канал Смеха
Рет қаралды 4,6 МЛН
Smart Sigma Kid #funny #sigma
00:33
CRAZY GREAPA
Рет қаралды 39 МЛН
How Strong Is Tape?
00:24
Stokes Twins
Рет қаралды 48 МЛН
What The Heck Are Kubernetes Resources, CRs, CRDs, Operators, etc.?
21:08
Is eBPF The End Of Kubernetes Sidecar Containers?
16:01
DevOps Toolkit
Рет қаралды 20 М.
Gateway API - Ingress And Service Mesh Spec Replacement?
23:30
DevOps Toolkit
Рет қаралды 30 М.
Kubernetes Services networking
7:13
Project Calico
Рет қаралды 93 М.
Kubernetes, network [01], Теория
31:25
Артур Крюков
Рет қаралды 13 М.
Day 26/40 - Kubernetes Network Policies Explained
45:48
Tech Tutorials with Piyush
Рет қаралды 4,5 М.
Kubernetes Network Policy Deep Dive
17:46
Kubesimplify
Рет қаралды 1,7 М.
10 Must-Have Kubernetes Tools
18:53
DevOps Toolkit
Рет қаралды 40 М.
Do NOT Learn Kubernetes Without Knowing These Concepts...
13:01
Travis Media
Рет қаралды 332 М.
Kubernetes Network Policy Tutorial - yaml explained + Demo Calico
15:35
Chain Game Strong ⛓️
00:21
Anwar Jibawi
Рет қаралды 39 МЛН