Use ACK GlobalNetworkPolicy

Syntax

The basic structure of an ACK GlobalNetworkPolicy is as follows:

apiVersion: network.alibabacloud.com/v1beta2
kind: GlobalNetworkPolicy
metadata:
  name: example
spec:
  podSelector:      # Selects the Pods to which this policy applies. If empty, the policy applies to all Pods in the selected namespaces.
    matchLabels:
      foo: bar      # Selects Pods with the label foo:bar.
  namespaceSelector:   # Selects the namespaces to which this policy applies. If empty, the policy applies to all namespaces. This selector is combined with podSelector by using a logical AND.
    matchLabels:
      foo: bar      # Selects namespaces with the label foo:bar.
  policyTypes:      # Specifies the traffic direction (Ingress, Egress, or both) that this policy enforces.
    - Ingress       # The policy applies to ingress traffic.
    - Egress        # The policy applies to egress traffic.
  ingress: []       # Ingress rules.
  egress: []        # Egress rules.

Ingress and egress rules

The ingress and egress rules define the source and destination addresses for traffic that an ACK GlobalNetworkPolicy allows. Both rule types have the same structure and specify the scope of allowed communication through from for ingress and to for egress.

apiVersion: network.alibabacloud.com/v1beta2
kind: GlobalNetworkPolicy
metadata:
  name: example                          # Policy name
spec:
  podSelector: {}
  namespaceSelector: null
  policyTypes:
    - Ingress                            # The policy includes ingress rules.
    - Egress                             # The policy includes egress rules.
  ingress:
    - from:
        - namespaceSelector:             # Allows ingress traffic from Pods in namespaces with matching labels.
            matchLabels:
              foo: bar
          podSelector:                   # Allows ingress traffic from Pods with matching labels.
            matchLabels:
              foo: bar
      ports:
        - protocol: TCP                # Allows TCP traffic. Valid values: TCP, UDP.
          port: 443                    # Allows traffic on port 443.
    - from:
        - ipBlock:                       # Specifies the CIDR range for allowed ingress traffic from outside the cluster.
            cidr: "172.16.0.0/16"
            except:
              - "172.16.1.0/24"          # Excludes a specific CIDR range from the allowed sources.
  egress:
    - to:
        - namespaceSelector:             # Allows egress traffic to Pods in namespaces with matching labels.
            matchLabels:
              foo: bar
          podSelector:                   # Allows egress traffic to Pods with matching labels.
            matchLabels:
              foo: bar
    - to:
        - ipBlock:                       # Specifies the CIDR range for allowed egress traffic to outside the cluster.
            cidr: "172.16.0.0/16"
            except:
              - "172.16.1.0/24"          # Excludes a specific CIDR range from the allowed egress destinations.

The following table describes the parameters that select traffic addresses outside and inside the cluster. The comments in the preceding example describe the other parameters.

When you create a network policy, you cannot use ipBlock together with podSelector or namespaceSelector in the same rule. Separate ipBlock and podSelector as follows:

ingress:
  - from:
      - ipBlock:               # The first source is an ipBlock.
          cidr: "192.168.0.0/16"
      - podSelector:           # The second source is a podSelector.
          matchLabels:
            key: value
    ports:
      - protocol: TCP
        port: 80

The following example is invalid and causes a conflict, because ipBlock and podSelector appear in the same item:

ingress:
  - from:
      - ipBlock:                  # Defines a CIDR range.
          cidr: "192.168.0.0/16"
        podSelector:              # Invalid: cannot be used together with ipBlock in the same item.
          matchLabels:
            key: value
    ports:
      - protocol: TCP
        port: 443

Deny all traffic for specific Pods

The following YAML file defines a GlobalNetworkPolicy that applies only to Pods with the foo: bar label and denies all ingress and egress traffic for those Pods.

apiVersion: network.alibabacloud.com/v1beta2
kind: GlobalNetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector:
    matchLabels:
      foo: bar
  namespaceSelector: null
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress: []

Allow specific Pods to access DNS

The following YAML file defines a GlobalNetworkPolicy that applies only to Pods with the foo: bar label and allows those Pods to communicate with the DNS service that runs in the cluster.

apiVersion: network.alibabacloud.com/v1beta2
kind: GlobalNetworkPolicy
metadata:
  name: allow-dns
spec:
  podSelector:
    matchLabels:
      foo: bar
  namespaceSelector: null
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns