Configuring Kubernetes network policies

This topic explains how to use Kubernetes network policies to secure Cassandra and Redis pods within an Apigee Hybrid Cluster .

Overview

When you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you can use Kubernetes Network Policies for applications in your cluster. Network Policies are an application-centric construct you can use to specify how a pod is allowed to communicate with other pods in your cluster.

In Apigee hybrid you can use Kubernetes Network Policies to isolate Cassandra pods so that only pods that are intended to communicate with Cassandra are allowed to, such as the Runtime, Synchronizer, and Mart pods. Other pods in the cluster like Ingres and Watcher pods that do not need to communicate with Cassandra are blocked from doing so.

If you have no restrictions on which pods can interact within your cluster, you do not need to use Kubernetes network policies.

Prerequisites

Enable network policies in your cluster.
- GKE: See Enabling network policy enforcement.
- EKS: See Installing the Calico network policy engine add-on.
- AKS: See Secure traffic between pods using network policies in Azure Kubernetes Service (AKS) .
- Other platforms: look for instructions to enable network policies on your cluster from your specific platform vendor.
A currently running Apigee hybrid cluster, version 1.8 or newer.

Procedure

Download and extract the apigeectl release package.

Note: apigeectl is only supported for Apigee hybrid versions 1.11 and older. The following command will download the latest release of apigeectl for Apigee hybrid version 1.11.

Linux

curl -LO \
  https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_linux_64.tar.gz

Mac OS

curl -LO \
  https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_mac_64.tar.gz

Windows

curl -LO ^
   https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_windows_64.zip

The configuration files for the Kubernetes network policies for Cassandra and Redis are in the following directory structure within the apigeectl directory:

  └── apigeectl
      └── examples
          └── network-policies
              └── securing-cassandra-redis-pods
                  ├── README.md
                  ├── base
                  │   └── cluster-scoped-communication
                  │       ├── cassandra
                  │       │   ├── kustomization.yaml
                  │       │   ├── networkpolicy-cassandra-allow-controller.yaml
                  │       │   ├── networkpolicy-cassandra-allow-intranode.yaml
                  │       │   ├── networkpolicy-cassandra-allow-mart.yaml
                  │       │   ├── networkpolicy-cassandra-allow-runtime.yaml
                  │       │   ├── networkpolicy-cassandra-alow-sync.yaml
                  │       │   ├── networkpolicy-cassandra-create-user.yaml
                  │       │   ├── networkpolicy-cassandra-monitoring.yaml
                  │       │   └── networkpolicy-cassandra-remove-dc.yaml
                  │       └── redis
                  │           ├── kustomization.yaml
                  │           ├── networkpolicy-redis-envoy.yaml
                  │           └── networkpolicy-redis.yaml
                  └── overlays
                      └── ORG_NAME
                          └── kustomization.yaml

Where ORG_NAME is the name of your Apigee organization.

Label the namespace with the following command:
```
kubectl label namespace APIGEE_NAMESPACE app=apigee
```
Note: Note: You can use any namespace. apigee is the default namespace. If you use a different namespace, be sure to replace APIGEE_NAMESPACE with the name of your namespace in the following commands.

Apply the network policies with the following command:

kubectl apply -k ${APIGEECTL_HOME}/examples/network-policies/securing-cassandra-redis-pods/overlays/ORG_NAME

Validate that the network policies were applied with the following command:

kubectl get netpol -n APIGEE_NAMESPACE

The following network policies should be created in the APIGEE_NAMESPACE namespace:

      NAME                        POD-SELECTOR              AGE
      cassandra-from-mart         app=apigee-cassandra      4d5h
      cassandra-from-runtime      app=apigee-cassandra      4d5h
      cassandra-from-sync         app=apigee-cassandra      4d5h
      cassandra-to-cassandra      app=apigee-cassandra      4d5h
      controller-to-cassandra     app=apigee-cassandra      4d5h
      redis-from-redisenvoy       app=apigee-redis          3d18h
      redisenvoy-from-runtime     app=apigee-redis-envoy    3d18h