calico.md

These are my notes testing:

• Calico on Tectonic
• New (and undocumented) SystemNetworkPolicy TPR introduced in calico-lib

1. Clone the repo containing the Calico additions and switch to the appropriate branch.

$ git clone abhinavdahiya [email protected]:abhinavdahiya/tectonic-installer.git &&\
   cd tectonic-installer &&\
   git checkout calico_policy_support

2. Create the tf vars for the specific platform

$ PLATFORM=aws CLUSTER=calico make localconfig

3. Configure the tfvars

$ vim build/calico/terraform.tfvars

4. Apply the config (plan first if preferred)

$ PLATFORM=aws CLUSTER=calico make apply

5. Create namespace

$ kubectl create ns policy-demo

6. Set default rule to disallow all ingress to pods in namespace.

kubectl create -f - <<EOF
kind: NetworkPolicy
apiVersion: extensions/v1beta1
metadata:
  name: default-deny
  namespace: policy-demo
spec:
  podSelector:
EOF

7. In the namespace policy-demo, disallow all egress traffic, unless the egress traffic's destination is in the namespace policy-demo. In other words, pods running in policy-demo may only send traffic to other pods in policy-demo. Note the SNP must be created in kube-system, otherwise felix will not enforce it.

apiVersion: "alpha.projectcalico.org/v1"
kind: SystemNetworkPolicy
metadata:
  name: ns-egress
  namespace: kube-system
spec:
  selector: calico/k8s_ns == 'policy-demo'
  order: 500
  egress:
  - action: deny
    destination:
      notSelector: calico/k8s_ns == 'policy-demo'

8. Allow pods with the label run=nginx inside of namespace policy-demo to accept traffic on port 80 from pods labeled run=access inside of namespace policy-demo. Note the SNP must be created in kube-system, otherwise felix will not enforce it.

apiVersion: "alpha.projectcalico.org/v1"
kind: SystemNetworkPolicy
metadata:
  name: policy-demo-app-class
  namespace: kube-system
spec:
  order: 0
  selector: calico/k8s_ns == 'policy-demo'
  ingress:
  - action: allow
    protocol: tcp
    source:
      selector: calico/k8s_ns == 'policy-demo' && run == 'access'
    destination:
      selector: calico/k8s_ns == 'policy-demo' && run == 'nginx'
      ports: [80]

9. Run nginx

kubectl run --namespace=policy-demo nginx --replicas=2 --image=nginx &&\
kubectl expose --namespace=policy-demo deployment nginx --port=80

10. Run busybox

kubectl run --namespace=policy-demo access --rm -ti --image busybox /bin/sh

11. Call the cluster-ip of the nginx service, observe traffic is now routeable.

12. Remove the above policies 1 by 1 to verify access is removed. (ie be sure to start another busy box and test that the policy you removed has not restricted access).