---
# System prepended metadata

title: 2021-06-23 Cilium Network Policy

---

---
lang: ja
breaks: false
---

<style>
.ui-infobar, #doc.markdown-body { max-width: 1100px; }
</style>

# 2021-06-23 Cilium Network Policy

## 検証環境

- minikube on MBP
- Cilium v1.8.0

## 検証環境構築

### Kubernetes構築

```
$ minikube start --driver virtualbox --cni cilium
```

### Pod構築

```
$ kubectl -n default apply -f pods.yaml
$ cat pods.yaml
---
apiVersion: v1
kind: Pod
metadata:
  name: netshoot1
  namespace: default
  labels:
    app: netshoot1
spec:
  containers:
  - name: tmp-shell
    args:
    - /sbin/init
    image: nicolaka/netshoot
---
apiVersion: v1
kind: Pod
metadata:
  name: netshoot2
  namespace: default
  labels:
    app: netshoot2
spec:
  containers:
  - name: tmp-shell
    args:
    - /sbin/init
    image: nicolaka/netshoot
---
apiVersion: v1
kind: Pod
metadata:
  name: netshoot3
  namespace: default
  labels:
    app: netshoot3
spec:
  containers:
  - name: tmp-shell
    args:
    - /sbin/init
    image: nicolaka/netshoot
---
apiVersion: v1
kind: Pod
metadata:
  name: ubnuntu
  namespace: default
  labels:
    app: ubuntu
spec:
  containers:
  - name: tmp-shell
    command:
      - /bin/sh
      - -c
      - "tail -f /dev/null"
    image: ubuntu:latest
```

### Cilium Network Policy (HTTP)

```
$ kubectl -n default apply -f cilium_network_policy.yaml
$ cat cilium_network_policy.yaml
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "l7-rule"
spec:
  endpointSelector:
    matchLabels:
      app: netshoot1
  ingress:
  - toPorts:
    - ports:
      - port: '8000'
        protocol: TCP
      rules:
        http:
        - method: GET
          path: "/test1$"
        - method: GET
          path: "/test2$"
          headers:
          - 'X-Test: true'
```

- 中身はTPROXY + Envoyの透過プロキシ

### Cilium Network Policy (DNS)

```
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: "tofqdn-dns-visibility"
spec:
  endpointSelector:
    matchLabels:
      app: ubuntu
  egress:
  - toEndpoints:
    - matchLabels:
       "k8s:io.kubernetes.pod.namespace": kube-system
       "k8s:k8s-app": kube-dns
    toPorts:
      - ports:
         - port: "53"
           protocol: ANY
        rules:
          dns:
            - matchName: "cilium.io"
            - matchPattern: "*.cilium.io"
            - matchPattern: "*.api.cilium.io"
            - matchPattern: "google.com"

  - toFQDNs:
      - matchName: "cilium.io"
      - matchName: "sub.cilium.io"
      - matchName: "service1.api.cilium.io"
      - matchPattern: "special*service.api.cilium.io"
    toPorts:
      - ports:
         - port: "80"
           protocol: TCP
```

- 中身はCilium-AgentのDNSプロキシ

### Ref
- [Network Policy — Cilium 1.8.10 documentation](https://docs.cilium.io/en/v1.8/policy/)
- [cilium/examples/policies/getting-started at master · cilium/cilium](https://github.com/cilium/cilium/tree/master/examples/policies/getting-started)
- [Scaling container policy management with kernel features](https://linuxplumbersconf.org/event/4/contributions/464/attachments/278/535/lpc19-scale-policy-slides.pdf)
- [Stand-alone load balancer](https://cilium.io/blog/2021/05/20/cilium-110)
- [Cilium Network Performance](https://cilium.io/blog/2021/05/11/cni-benchmark)
- [cilium/dns.go at master · cilium/cilium](https://github.com/cilium/cilium/blob/master/pkg/proxy/dns.go)