How to allow/deny http requests from other namespaces of the same cluster?
In a cluster with 2 namespaces (ns1 and ns2), I deploy the same app (deployment) and expose it with a service.
I thought separate namespaces would prevent from executing curl http://deployment.ns1 from a pod in ns2, but apparently, it's possible.
So my question is, how to allow/deny such cross namespaces operations? For example:
- pods in
ns1should accept requests from any namespace - pods (or service?) in
ns2should deny all requests from other namespaces
kubernetes kubernetes-networkpolicy
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
asked Jan 19 at 14:07
znatznat
7,096114880
add a comment |
In a cluster with 2 namespaces (ns1 and ns2), I deploy the same app (deployment) and expose it with a service.
I thought separate namespaces would prevent from executing curl http://deployment.ns1 from a pod in ns2, but apparently, it's possible.
So my question is, how to allow/deny such cross namespaces operations? For example:
- pods in
ns1should accept requests from any namespace - pods (or service?) in
ns2should deny all requests from other namespaces
kubernetes kubernetes-networkpolicy
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
asked Jan 19 at 14:07
znatznat
7,096114880
How are you deploying OpenShift? If you are usingoc cluster uporminishift, the SDN layer required to provide separation isn't installed. A full OpenShift cluster install should.
– Graham Dumpleton
Jan 20 at 19:34
@graham Someone edited the question and added the openshift tag, but the question was related to Kubernetes
– znat
Jan 21 at 20:15
Okay, worth highlighting then, is that one of the things you get with OpenShift is multi tenancy out of the box. This means namespaces (projects) are isolated by default and you don't need to go adding it on top of Kubernetes yourself.
– Graham Dumpleton
Jan 22 at 4:00
add a comment |
In a cluster with 2 namespaces (ns1 and ns2), I deploy the same app (deployment) and expose it with a service.
I thought separate namespaces would prevent from executing curl http://deployment.ns1 from a pod in ns2, but apparently, it's possible.
So my question is, how to allow/deny such cross namespaces operations? For example:
- pods in
ns1should accept requests from any namespace - pods (or service?) in
ns2should deny all requests from other namespaces
kubernetes kubernetes-networkpolicy
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
asked Jan 19 at 14:07
znatznat
7,096114880
In a cluster with 2 namespaces (ns1 and ns2), I deploy the same app (deployment) and expose it with a service.
I thought separate namespaces would prevent from executing curl http://deployment.ns1 from a pod in ns2, but apparently, it's possible.
So my question is, how to allow/deny such cross namespaces operations? For example:
- pods in
ns1should accept requests from any namespace - pods (or service?) in
ns2should deny all requests from other namespaces
kubernetes kubernetes-networkpolicy
kubernetes kubernetes-networkpolicy
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
asked Jan 19 at 14:07
znatznat
7,096114880
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
asked Jan 19 at 14:07
znatznat
7,096114880
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
edited Jan 22 at 4:00
Graham Dumpleton
48.3k680106
48.3k680106
asked Jan 19 at 14:07
znatznat
7,096114880
asked Jan 19 at 14:07
znatznat
7,096114880
asked Jan 19 at 14:07
znatznat
7,096114880
7,096114880
How are you deploying OpenShift? If you are usingoc cluster uporminishift, the SDN layer required to provide separation isn't installed. A full OpenShift cluster install should.
– Graham Dumpleton
Jan 20 at 19:34
@graham Someone edited the question and added the openshift tag, but the question was related to Kubernetes
– znat
Jan 21 at 20:15
Okay, worth highlighting then, is that one of the things you get with OpenShift is multi tenancy out of the box. This means namespaces (projects) are isolated by default and you don't need to go adding it on top of Kubernetes yourself.
– Graham Dumpleton
Jan 22 at 4:00
add a comment |
How are you deploying OpenShift? If you are usingoc cluster uporminishift, the SDN layer required to provide separation isn't installed. A full OpenShift cluster install should.
– Graham Dumpleton
Jan 20 at 19:34
@graham Someone edited the question and added the openshift tag, but the question was related to Kubernetes
– znat
Jan 21 at 20:15
Okay, worth highlighting then, is that one of the things you get with OpenShift is multi tenancy out of the box. This means namespaces (projects) are isolated by default and you don't need to go adding it on top of Kubernetes yourself.
– Graham Dumpleton
Jan 22 at 4:00
How are you deploying OpenShift? If you are using
oc cluster up or minishift, the SDN layer required to provide separation isn't installed. A full OpenShift cluster install should.– Graham Dumpleton
Jan 20 at 19:34
How are you deploying OpenShift? If you are using
oc cluster up or minishift, the SDN layer required to provide separation isn't installed. A full OpenShift cluster install should.– Graham Dumpleton
Jan 20 at 19:34
@graham Someone edited the question and added the openshift tag, but the question was related to Kubernetes
– znat
Jan 21 at 20:15
@graham Someone edited the question and added the openshift tag, but the question was related to Kubernetes
– znat
Jan 21 at 20:15
Okay, worth highlighting then, is that one of the things you get with OpenShift is multi tenancy out of the box. This means namespaces (projects) are isolated by default and you don't need to go adding it on top of Kubernetes yourself.
– Graham Dumpleton
Jan 22 at 4:00
Okay, worth highlighting then, is that one of the things you get with OpenShift is multi tenancy out of the box. This means namespaces (projects) are isolated by default and you don't need to go adding it on top of Kubernetes yourself.
– Graham Dumpleton
Jan 22 at 4:00
add a comment |
2 Answers
2
active
oldest
votes
Good that you are working with namespace isolation.
Deploy a new kind Network Policy in your ns1 with ingress all. You can lookup the documentation to define network ingress policy to allow all inbound traffic
Likewise for ns2, you can create a new kind Network Policy and deploy the config in ns2 to deny all ingress. Again the docs will come to rescue to help with you the yaml construct.
It may look something like this:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
namespace: ns1
name: web-allow-all-namespaces
spec:
podSelector:
matchLabels:
app: app_name_ns1
ingress:
- from:
- namespaceSelector: {}
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
add a comment |
It would not be answer you want, but I can provide the helpful feature information to implement your requirements.
AFAIK Kubernetes can define network policy to limit the network access.
Refer Declare Network Policy for more details of Network Policy.
- Default policies
Setting a Default NetworkPolicy for New Projects in caseOpenShift.
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54267922%2fhow-to-allow-deny-http-requests-from-other-namespaces-of-the-same-cluster%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Good that you are working with namespace isolation.
Deploy a new kind Network Policy in your ns1 with ingress all. You can lookup the documentation to define network ingress policy to allow all inbound traffic
Likewise for ns2, you can create a new kind Network Policy and deploy the config in ns2 to deny all ingress. Again the docs will come to rescue to help with you the yaml construct.
It may look something like this:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
namespace: ns1
name: web-allow-all-namespaces
spec:
podSelector:
matchLabels:
app: app_name_ns1
ingress:
- from:
- namespaceSelector: {}
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
add a comment |
Good that you are working with namespace isolation.
Deploy a new kind Network Policy in your ns1 with ingress all. You can lookup the documentation to define network ingress policy to allow all inbound traffic
Likewise for ns2, you can create a new kind Network Policy and deploy the config in ns2 to deny all ingress. Again the docs will come to rescue to help with you the yaml construct.
It may look something like this:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
namespace: ns1
name: web-allow-all-namespaces
spec:
podSelector:
matchLabels:
app: app_name_ns1
ingress:
- from:
- namespaceSelector: {}
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
add a comment |
Good that you are working with namespace isolation.
Deploy a new kind Network Policy in your ns1 with ingress all. You can lookup the documentation to define network ingress policy to allow all inbound traffic
Likewise for ns2, you can create a new kind Network Policy and deploy the config in ns2 to deny all ingress. Again the docs will come to rescue to help with you the yaml construct.
It may look something like this:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
namespace: ns1
name: web-allow-all-namespaces
spec:
podSelector:
matchLabels:
app: app_name_ns1
ingress:
- from:
- namespaceSelector: {}
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
Good that you are working with namespace isolation.
Deploy a new kind Network Policy in your ns1 with ingress all. You can lookup the documentation to define network ingress policy to allow all inbound traffic
Likewise for ns2, you can create a new kind Network Policy and deploy the config in ns2 to deny all ingress. Again the docs will come to rescue to help with you the yaml construct.
It may look something like this:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
namespace: ns1
name: web-allow-all-namespaces
spec:
podSelector:
matchLabels:
app: app_name_ns1
ingress:
- from:
- namespaceSelector: {}
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
answered Jan 19 at 20:53
Raunak JhawarRaunak Jhawar
4501412
4501412
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
add a comment |
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
Thanks for pointing me to network policies
– znat
Jan 20 at 17:59
add a comment |
It would not be answer you want, but I can provide the helpful feature information to implement your requirements.
AFAIK Kubernetes can define network policy to limit the network access.
Refer Declare Network Policy for more details of Network Policy.
- Default policies
Setting a Default NetworkPolicy for New Projects in caseOpenShift.
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
add a comment |
It would not be answer you want, but I can provide the helpful feature information to implement your requirements.
AFAIK Kubernetes can define network policy to limit the network access.
Refer Declare Network Policy for more details of Network Policy.
- Default policies
Setting a Default NetworkPolicy for New Projects in caseOpenShift.
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
add a comment |
It would not be answer you want, but I can provide the helpful feature information to implement your requirements.
AFAIK Kubernetes can define network policy to limit the network access.
Refer Declare Network Policy for more details of Network Policy.
- Default policies
Setting a Default NetworkPolicy for New Projects in caseOpenShift.
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
It would not be answer you want, but I can provide the helpful feature information to implement your requirements.
AFAIK Kubernetes can define network policy to limit the network access.
Refer Declare Network Policy for more details of Network Policy.
- Default policies
Setting a Default NetworkPolicy for New Projects in caseOpenShift.
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
edited Jan 19 at 16:20
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
answered Jan 19 at 16:09
Daein ParkDaein Park
1,04539
1,04539
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54267922%2fhow-to-allow-deny-http-requests-from-other-namespaces-of-the-same-cluster%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How are you deploying OpenShift? If you are using
oc cluster uporminishift, the SDN layer required to provide separation isn't installed. A full OpenShift cluster install should.– Graham Dumpleton
Jan 20 at 19:34
@graham Someone edited the question and added the openshift tag, but the question was related to Kubernetes
– znat
Jan 21 at 20:15
Okay, worth highlighting then, is that one of the things you get with OpenShift is multi tenancy out of the box. This means namespaces (projects) are isolated by default and you don't need to go adding it on top of Kubernetes yourself.
– Graham Dumpleton
Jan 22 at 4:00