CODEWITHSUNDEEP
kuberneteskubernetes-ingresskubernetes-podkube-proxy
The Entity
The Entity

Reputation: 167

Restrict access to service to only some pods

I have a mosquitto broker running on a pod, this server is exposed as a service as both DNS and IP address.

But this service is accessible by any pod in the cluster.

I want to restrict access to this service such that pods trying to connect to this DNS or IP address should only be able to if the pods have certain name/metadata.

One solution I guess will be to use namespaces? What other solution is there?

Upvotes: 4

Views: 2751

Answers (1)

meaningqo
meaningqo

Reputation: 1948

The UseCase you are describing is exactly what NetworkPolicies are here for.

Basically you define selector for pods which the network traffic should be restricted (i.e. your mosquito broker) and what specifica pods need to have in order to be allowed to reach it. For example a label "broker-access: true" or whatever seems to be suitable for you.

an example network policy could look like this:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: broker-policy
  namespace: default  
spec:
  podSelector:
    matchLabels:
      role: message-broker
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          broker-access: true
    ports:
    - protocol: TCP
      port: 6379

this network policy would be applied to every pod with label role=message-broker. and it would restrict all incoming traffic except for traffic from pods with label broker-acces=true on port 6379.

Hope this helps and gives you a bit of a skaffold for your NetworkPolicy

Upvotes: 7

Related Questions