[K8S] Network Policy 정의하기

모든 Pod의 Egress, Ingress를 차단

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: deny

spec:

  podSelector: {}

  policyTypes:

  - Egress

  - Ingress

[hr]
위 설정에서 DNS(53포트)는 허용

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: deny

spec:

  podSelector: {}

  policyTypes:

  - Egress

  - Ingress

  egress:

  - to:

    ports:

      - port: 53

        protocol: TCP

      - port: 53

        protocol: UDP

[hr]
특정 namespace에 대해 9000 포트만 허용

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: allow-9000-from-namespace

spec:

  podSelector: {}

  policyTypes:

  - Ingress

  ingress:

  - from:

    - namespaceSelector:

        matchLabels:

          color: pink

    ports:

      - port: 9000

        protocol: TCP