Should we keep all egress of a pod in a single k8s NetworkPolicy?

149 views Asked by At

I have a pod which emits metrics and it has multiple egresses associated like -

  1. authentication endpoint (tcp/443)
  2. dns (udp/53)
  3. instance metadata (tcp/80)
  4. other pods (all)

What would be a good practice to define the policies for all of the above -

1 - all egresses in a single NetworkPolicy

Example (Same policy with all egress)

apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: metrics-emitter-egress-to-multiple-points
    spec:
      podSelector:
        matchLabels:
          name: metrics-emitter
      policyTypes:
      - Egress
      egress:
      - to:
        - ipBlock:
            cidr: 0.0.0.0/0
        ports:
        - protocol: TCP
          port: 443
      - to:
        ports:
        - protocol: UDP
          port: 53
      - to:
        - ipBlock:
            cidr: 0.0.0.0/0
        ports:
        - protocol: TCP
          port: 9443
    

OR

2 - different NetworkPolicy for each of the egress

Example (Different NetPol for each) -

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: metrics-emitter-egress-to-auth-endpoint
spec:
  podSelector:
    matchLabels:
      name: metrics-emitter
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 443

 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: metrics-emitter-egress-to-dns
 spec:
   podSelector:
     matchLabels:
       name: metrics-emitter
   policyTypes:
   - Egress
   egress:
   - to:
     ports:
     - protocol: UDP
       port: 53

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: metrics-emitter-egress-to-api-server
spec:
  podSelector:
    matchLabels:
      name: metrics-emitter
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 9443
1

There are 1 answers

0
Harsh Manvar On

Would be better to manage all policy in single otherwise you will have to go through tons of similar line.

Also easily would be helpful to mitigate any issue if a similar policy is being added or overwriting happens.