I have a Kubernetes cluster with Calico network overlay installed in it. How do I configure a network policy object to prevent pods connecting to the port 10250 (kubelet API) on the nodes? I have something along these lines:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: deny-egress-to-nodes
namespace: dev
spec:
podSelector: {}
policyTypes:
- Egress
- Ingress
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 172.20.0.0/16
ingress:
- {}
This doesn't specifically block port 10250, though. It blocks all egress connections to the nodes, which also blocks communication between the application services running in the cluster. Is there a way to block only egress connections to the port 10250 in the cluster nodes? I know it can be done through IPTABLES, but I'd rather do it via Calico using a network policy object.
Reference: https://raesene.github.io/blog/2018/03/25/kubernetes-network-policies/