Securing Cluster Networking with Network Policies - Ahmet Balkan, Google

Securing Cluster Networking with Network Policies - Ahmet Balkan, Google
In a secure microservices cluster, you should only have the pods that need to communicate with each other to be able to establish network connections, and block all others. But how? Until recently, Kubernetes users could not enforce policies for container networking.
First introduced in Kubernetes 1.3, Network Policies are now a stable feature in Kubernetes 1.7. In this talk, we will discuss use cases for network policies, the Network Policy API, how to configure network policies, and how the configured policies are enforced. We will also present some network policies that address some common use cases and are relevant to securing your Kubernetes clusters.
Also, we will discuss the roadmap for Network Policies feature, other methods you can use to secure applications at network and application layers, and how Network Policies relate to service mesh projects such as Istio that offer similar functionality.
About Ahmet Alp Balkan
Ahmet is a software engineer at Google Kubernetes Engine, working on optimizing the developer experiences. He creates developer tools and tells stories about complicated features.
Previously, he has worked on Microsoft Azure on projects like porting Docker to Windows and Azure Container Registry.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

[@veramentegina]

Great talk. Network Policies are definitely being underutilized. Thanks for clarifying all that.

[@kansalmukul1]

Truly amazing....

[@msohan01]

Great explanation and overview of Network Policies

[@7aydarah]

Perfect explination with hand drawn schema.

[@dineshkumarsaravanan5893]

tq so much ahmet its very useful

[@tejsinghranaofficial]

Nicely Explained!!

[@arunpln]

Very useful.

[@phannguyen1556]

Wonderful talk about Network Policies!!! It's very useful, Ahmet. Cheers!

[@khalidgraysen4848]

i dont mean to be offtopic but does someone know of a method to get back into an Instagram account?? I somehow forgot the account password. I would appreciate any assistance you can offer me.

[@cristianobrayden8712]

@Khalid Graysen instablaster ;)

[@khalidgraysen4848]

@Cristiano Brayden i really appreciate your reply. I got to the site on google and im waiting for the hacking stuff atm. Takes quite some time so I will reply here later when my account password hopefully is recovered.

[@khalidgraysen4848]

@Cristiano Brayden it worked and I now got access to my account again. I'm so happy:D Thanks so much, you saved my ass !

[@cristianobrayden8712]

@Khalid Graysen Happy to help :)

[@cptechno]

It's a useful tool indeed, but I profoundly disagree with logic that's being used in writing rules. Empty should mean Empty. An empty bracket ( [ ] ) should mean NO node! If ALL nodes want to be specified than a symbol like '*' (wildcard) should be used. The set could be read as [ * ]. That's the way it has always been and I don't see any reasons why we should stray from that true and tested historic symbolic protocol. Allowing the reverse of logic, where empty bracket means 'all nodes' can be the source of costly errors in big projects.

[@matthartstonge]

Had a quick think about this, I compare it to NoSQL(mongo) and RESTful APIs, where if you specify nothing to filter by, you get all the things!

[@yahyabilge9765]

Some little confusion about cdir vs cidr :) But gorgeous explanation and presentation

[@pythonsriracha4944]

at 8:47 , don't you mean all ports are closed by default? or am I missing something?

[@dsinghr]

Isn't RBAC does the same thing? It allows specific microservices to talk to specific microservices. Similar to what NetworkPolicies does..

[@Aliennnaa]

network policies usually works on layer 4 or 3 of osi ,where is rbac are at the endpoint talking to the api server to get authorization so layer 7

[@AbdoTawdy]

27:38 he is saying that he would ask this question to a "community " called "signal works" , dose anyone know exactly this community name , thanks

[@thebsv]

#sig-network channel on kubernetes in Slack

[@TiexinGuo]

I wouldn’t listen to a guy talking about network who reads CIDR as CDIR multiple times.

[@zamboz01]

Yeaa like he is doing it on purpose not because there are hundreds of people in front of him. He miss spoke a few times but it is normal in that setting. But you will never know.