~/ nmadiraju.com Amazon EKS · Network Policies
arrow_back Back to nmadiraju
Visual Walkthrough · Kubernetes networking

How Network Policies Work on Amazon EKS

Follow the connections into the db Pod as policies close it, its namespace and its egress, then check yourself with 8 questions.

1Visual Walkthrough

Pods in three namespaces on EKS, NetworkPolicies in the Kubernetes API, and the VPC CNI agent that enforces them Namespace shop holds web, api and db (Postgres). Namespace analytics holds reports and a debug Pod, toolbox. kube-system holds CoreDNS and the VPC CNI's network policy agent. On the right, the NetworkPolicies db-allow-api, default-deny, api-allow-web, allow-egress and db-allow-reports. The walkthrough shows toolbox reaching db by default, a policy with nothing enforcing it, enforcement turned on, unselected Pods left open, default deny, additive allows, egress deny breaking DNS, and two from entries acting as OR. Platform team kubectl apply VPC 10.0.0.0/16 · EKS CLUSTER shop-prod NAMESPACE shop Pod web app=web · 10.0.1.22 Pod api app=api · 10.0.2.31:8080 Pod db (Postgres) app=db · 10.0.3.15:5432 NAMESPACE analytics toolbox: a debug Pod someone left running, with a shell and network tools Pod reports app=reports Pod toolbox app=toolbox NAMESPACE kube-system CoreDNS k8s-app=kube-dns Service kube-dns 172.20.0.10:53 VPC CNI · aws-node network policy agent KUBERNETES API · POLICIES db-allow-api selects app=db in: app=api · TCP 5432 default-deny selects every Pod in shop api-allow-web selects app=api in: app=web · TCP 8080 allow-egress out: kube-dns · UDP+TCP 53 out: api :8080 · db :5432 db-allow-reports selects app=db

    2Quiz to check understanding

    Check yourself