Skip to content

Instantly share code, notes, and snippets.

@ellieayla
Created March 19, 2021 15:58
Show Gist options
  • Save ellieayla/0f502bb5db8c8bc82a547e56f658627c to your computer and use it in GitHub Desktop.
Save ellieayla/0f502bb5db8c8bc82a547e56f658627c to your computer and use it in GitHub Desktop.
Do I understand NetworkPolicy behavior?
# https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/policies/deny-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-ingress
spec:
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
egress:
- {}
podSelector: {}
# Do I understand Azure CNI and NetworkPolicy behavior?
apiVersion: v1
kind: Namespace
metadata:
name: np-test-1
---
apiVersion: v1
kind: Namespace
metadata:
name: np-test-2
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-in-np-test-1
namespace: np-test-1
spec:
replicas: 1
selector:
matchLabels:
app: nginx-in-np-test-1
strategy: {}
template:
metadata:
labels:
app: nginx-in-np-test-1
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
resources: {}
---
apiVersion: v1
kind: Service
metadata:
labels:
app: nginx-in-np-test-1
name: nginx-in-np-test-1
namespace: np-test-1
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
app: nginx-in-np-test-1
---
apiVersion: v1
kind: Pod
metadata:
labels:
app: np-test-curl
name: curl-from-inside-np-test-2
namespace: np-test-2
spec:
containers:
- command:
- sh
- -c
- |
while [ 1 ]; do
echo -n "$(date) pod=$MY_POD_NAME / $MY_POD_IP node=$MY_NODE_NAME namespace=$MY_POD_NAMESPACE: "
curl -s -o /dev/null --connect-timeout 2 -w "%{http_code}\n" http://nginx-in-np-test-1.np-test-1.svc.cluster.local
sleep 3
done
image: curlimages/curl:7.75.0
name: curl
resources: {}
env:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: MY_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: MY_POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: MY_POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
---
apiVersion: v1
kind: Pod
metadata:
labels:
app: np-test-curl
name: curl-from-inside-np-test-1
namespace: np-test-1
spec:
containers:
- command:
- sh
- -c
- |
while [ 1 ]; do
echo -n "$(date) pod=$MY_POD_NAME / $MY_POD_IP node=$MY_NODE_NAME namespace=$MY_POD_NAMESPACE: "
curl -s -o /dev/null --connect-timeout 2 -w "%{http_code}\n" http://nginx-in-np-test-1.np-test-1.svc.cluster.local
sleep 3
done
image: curlimages/curl:7.75.0
name: curl
env:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: MY_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: MY_POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: MY_POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment