Express YourSelf !

- We cannot use namespaceSelector, for target pod. The namespaceSelector is for (1) to and (2) from

- if we do not mention about podSelector at all, then it means none of the pod. 

- if we mention empty list , then also it means none of the pod. ingress: []

==================================

- For (1) to and (2) from, if you omit specifying a namespaceSelector it does not select any namespaces, which means it will allow traffic only from the namespace the NetworkPolicy is deployed to.

To allow all traffic from current namespace

ingress:

- from:

  - podSelector: {}

==================================

- if we mention 

ingress: {} 

OR

ingress:

- {}

then it means network all pods from all namespace + outside K8s cluster

- if we mention

  ingress:

  - from:

    - namespaceSelector: {}

==================================

- All policies are add / union. So there is no chance of conflict. Whitelist can be keep growing. Traffic is allowed, if we have at least one rule, that allow the traffic. 

- By default, if no policies exist in a namespace, then all ingress and egress traffic is allowed to and from pods in that namespace

- Network Policy is connection level filter. It does not apply to packets

- Network Policy does not terminate established connection. 

- cluster level network policy is not part of core API. It is implemented by Calico 

==================================

Best practices

1. First block all ingress/egress in a namespace

2. start whitelisting for each app

3. While applying egress rule, we have to allow DNS, as it is needed in most cases, to resolve service FQDN

==================================

- If no policyTypes are specified on a NetworkPolicy then by default Ingress will always be set 

- policyTypes= Egress will be set if the NetworkPolicy has any egress rules.

==================================

This is OR condition

  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
    - namespaceSelector:
        matchLabels:
          KEY: VALUE
    - podSelector:
        matchLabels:
          KEY: VALUE

Here : any pod whose namespace has label key=value OR any pod with namespace of Networkpolicy  (default) who has label key=value OR pod has specific IP addresss

==================================

This is AND condition

  ingress:

Port is always destination port, for both ingress and egress. 

==================================

We can block egress traffic go outside cluster, by (1) specifying allow to all namespace

egress:

- to:

  - namespaceSelector: {}

(2) empty list

egress: []

==================================

First let's isolate Ingress and Egress both traffic to target pod as per podSelector. These pods belongs to same namespace, as the NetworkPolicy belong to. Here all pods with label role=db in default namespace are isolated. 

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: test-network-policy

  namespace: default

spec:

  podSelector:

    matchLabels:

      role: db

  policyTypes:

  - Ingress

  - Egress

Reference:

https://kubernetes.io/docs/concepts/services-networking/network-policies/

https://github.com/ahmetb/kubernetes-network-policy-recipes

https://www.youtube.com/watch?v=3gGpMmYeEO8