Let's say I've created a cluster with a manifest like:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
spec:
replicas: 1
selector:
matchLabels:
app: my-app
template:
metadata:
labels:
app: my-app
use_db: "true"
backend: "true"
spec:
nodeSelector:
"beta.kubernetes.io/os": linux
containers:
- name: my-app
image: <...>
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
ports:
- containerPort: 80
- containerPort: <...>
---
apiVersion: v1
kind: Service
metadata:
name: my-app
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
type: LoadBalancer
ports:
- port: 80
selector:
app: my-app
I've activated the network plugin and network policies. It's working well. But I want to set up some network policies. I found many examples of how to manage traffic between pods, how to allow external traffic and traffic from all single seeds. But I can't understand how to be in my case. That's what I want:
- Deny traffic between all pods inside Kubernetes by default (I can do it).
- Allow external traffic to the pods labeled backend from some foreign subnet to port 80 (but not from internal seeds)
- Allow external traffic exchange with some database (I know it's DNS name and port) for pods with the label use_db
Please, can somebody give an example of the network policy YAML file for this case?