About this scenario
payments in the shop namespace calls two things: the payment provider at https://api.stripe.com and the internal ledger Service in finance. Security wants it to reach nothing else outside the cluster.
A colleague applied the payments-egress CiliumNetworkPolicy yesterday. Since then payments can't reach the provider or the ledger, and the calls time out.
Fix the policy without opening it up. hubble observe shows what Cilium forwards and drops, and payments-egress.yaml is in the editor. Test with kubectl exec deploy/payments -- curl -m 5 https://api.stripe.com.
Objectives
- See what Cilium drops for payments
- payments reaches https://api.stripe.com
- payments reaches the ledger at http://ledger.finance:8080
- payments still can't reach any other site, such as https://example.org
What you'll practice
toFQDNs turns a name into allowed addresses at run time. Cilium's DNS proxy watches the Pod's lookups and allows the addresses in the answers, so the Pod can only reach what it resolved itself while the policy was in place.- The proxy only sees DNS when the rule that allows port 53 has a
rules.dns block. Without it lookups work, nothing is learned, and every connection to the domain is dropped. matchName matches one exact name. matchPattern takes * as a wildcard within the name, so *.stripe.com covers subdomains and not stripe.com itself.- A policy with egress rules denies all other egress from the Pods it selects. Internal dependencies need their own
toEndpoints rule. hubble observe --verdict DROPPED names the source, the destination and the reason for each dropped connection, which beats guessing from a timeout.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Helm, Flux, Argo CD, Kyverno, Cilium, Istio) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.