https://archive-os-3-24.netlify.app/assets/js/c0932583.9b7f7511.js

1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([[5210],{3905:(e,t,n)=>{n.d(t,{Zo:()=>p,kt:()=>h});var a=n(67294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function l(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function r(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?l(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):l(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function i(e,t){if(null==e)return{};var n,a,o=function(e,t){if(null==e)return{};var n,a,o={},l=Object.keys(e);for(a=0;a<l.length;a++)n=l[a],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);for(a=0;a<l.length;a++)n=l[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var c=a.createContext({}),s=function(e){var t=a.useContext(c),n=t;return e&&(n="function"==typeof e?e(t):r(r({},t),e)),n},p=function(e){var t=s(e.components);return a.createElement(c.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},u=a.forwardRef((function(e,t){var n=e.components,o=e.mdxType,l=e.originalType,c=e.parentName,p=i(e,["components","mdxType","originalType","parentName"]),u=s(n),h=o,m=u["".concat(c,".").concat(h)]||u[h]||d[h]||l;return n?a.createElement(m,r(r({ref:t},p),{},{components:n})):a.createElement(m,r({ref:t},p))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var l=n.length,r=new Array(l);r[0]=u;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:o,r[1]=i;for(var s=2;s<l;s++)r[s]=n[s];return a.createElement.apply(null,r)}return a.createElement.apply(null,n)}u.displayName="MDXCreateElement"},25539:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>d,frontMatter:()=>l,metadata:()=>i,toc:()=>s});var a=n(87462),o=(n(67294),n(3905));const l={description:"An interactive demo that visually shows how applying Kubernetes policy allows and denies connections."},r="Kubernetes policy, demo",i={unversionedId:"network-policy/get-started/kubernetes-policy/kubernetes-demo",id:"version-3.24/network-policy/get-started/kubernetes-policy/kubernetes-demo",title:"Kubernetes policy, demo",description:"An interactive demo that visually shows how applying Kubernetes policy allows and denies connections.",source:"@site/calico_versioned_docs/version-3.24/network-policy/get-started/kubernetes-policy/kubernetes-demo.mdx",sourceDirName:"network-policy/get-started/kubernetes-policy",slug:"/network-policy/get-started/kubernetes-policy/kubernetes-demo",permalink:"/calico/3.24/network-policy/get-started/kubernetes-policy/kubernetes-demo",draft:!1,editUrl:"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.24/network-policy/get-started/kubernetes-policy/kubernetes-demo.mdx",tags:[],version:"3.24",frontMatter:{description:"An interactive demo that visually shows how applying Kubernetes policy allows and denies connections."},sidebar:"calicoSidebar",previous:{title:"Get started with Kubernetes network policy",permalink:"/calico/3.24/network-policy/get-started/kubernetes-policy/kubernetes-network-policy"},next:{title:"Kubernetes policy, basic tutorial",permalink:"/calico/3.24/network-policy/get-started/kubernetes-policy/kubernetes-policy-basic"}},c={},s=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Running the stars example",id:"running-the-stars-example",level:2},{value:"1) Create the frontend, backend, client, and management-ui apps.",id:"1-create-the-frontend-backend-client-and-management-ui-apps",level:3},{value:"2) Enable isolation",id:"2-enable-isolation",level:3},{value:"Confirm isolation",id:"confirm-isolation",level:4},{value:"3) Allow the UI to access the services using network policy objects",id:"3-allow-the-ui-to-access-the-services-using-network-policy-objects",level:3}

1,{value:"4) Create the backend-policy.yaml file to allow traffic from the frontend to the backend",id:"4-create-the-backend-policyyaml-file-to-allow-traffic-from-the-frontend-to-the-backend",level:3},{value:"5) Expose the frontend service to the client namespace",id:"5-expose-the-frontend-service-to-the-client-namespace",level:3},{value:"6) (Optional) Clean up the demo environment",id:"6-optional-clean-up-the-demo-environment",level:3}],p={toc:s};function d(e){let{components:t,...n}=e;return(0,o.kt)("wrapper",(0,a.Z)({},p,n,{components:t,mdxType:"MDXLayout"}),(0,o.kt)("h1",{id:"kubernetes-policy-demo"},"Kubernetes policy, demo"),(0,o.kt)("p",null,"The included demo sets up a frontend and backend service, as well as a client service, all\nrunning on Kubernetes. It then configures network policy on each service."),(0,o.kt)("h2",{id:"prerequisites"},"Prerequisites"),(0,o.kt)("p",null,"To create a Kubernetes cluster which supports the Kubernetes network policy API, follow\none of our ",(0,o.kt)("a",{parentName:"p",href:"/calico/3.24/getting-started/"},"getting started guides"),"."),(0,o.kt)("h2",{id:"running-the-stars-example"},"Running the stars example"),(0,o.kt)("h3",{id:"1-create-the-frontend-backend-client-and-management-ui-apps"},"1) Create the frontend, backend, client, and management-ui apps."),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-shell"},"kubectl create -f https://docs.tigera.io/files/00-namespace.yaml\nkubectl create -f https://docs.tigera.io/files/01-management-ui.yaml\nkubectl create -f https://docs.tigera.io/files/02-backend.yaml\nkubectl create -f https://docs.tigera.io/files/03-frontend.yaml\nkubectl create -f https://docs.tigera.io/files/04-client.yaml\n")),(0,o.kt)("p",null,"Wait for all the pods to enter ",(0,o.kt)("inlineCode",{parentName:"p"},"Running")," state."),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl get pods --all-namespaces --watch\n")),(0,o.kt)("blockquote",null,(0,o.kt)("p",{parentName:"blockquote"},"Note that it may take several minutes to download the necessary Docker images for this demo.")),(0,o.kt)("p",null,"The management UI runs as a ",(0,o.kt)("inlineCode",{parentName:"p"},"NodePort")," Service on Kubernetes, and shows the connectivity\nof the Services in this example."),(0,o.kt)("p",null,"You can view the UI by visiting ",(0,o.kt)("inlineCode",{parentName:"p"},"http://<k8s-node-ip>:30002")," in a browser."),(0,o.kt)("p",null,"Once all the pods are started, they should have full connectivity. You can see this by visiting the UI. Each service is\nrepresented by a single node in the graph."),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},(0,o.kt)("inlineCode",{parentName:"li"},"backend"),' -> Node "B"'),(0,o.kt)("li",{parentName:"ul"},(0,o.kt)("inlineCode",{parentName:"li"},"frontend"),' -> Node "F"'),(0,o.kt)("li",{parentName:"ul"},(0,o.kt)("inlineCode",{parentName:"li"},"client"),' -> Node "C"')),(0,o.kt)("h3",{id:"2-enable-isolation"},"2) Enable isolation"),(0,o.kt)("p",null,"Running following commands will prevent all access to the frontend, backend, and client Services."),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-shell"},"kubectl create -n stars -f https://docs.tigera.io/files/default-deny.yaml\nkubectl create -n client -f https://docs.tigera.io/files/default-deny.yaml\n")),(0,o.kt)("h4",{id:"confirm-isolation"},"Confirm isolation"),(0,o.kt)("p",null,"Refresh the management UI (it may take up to 10 seconds for changes to be reflected in the UI).\nNow that we've enabled isolation, the UI can no longer access the pods, and so they will no longer show up in the UI."),(0,o.kt)("h3",{id:"3-allow-the-ui-to-access-the-services-using-network-policy-objects"},"3) Allow the UI to access the services using network policy objects"),(0,o.kt)("p",null,"Apply the following YAML files to allow access from the management UI."),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-shell"},"kubectl create -f https://docs.tigera.io/files/allow-ui.yaml\nkubectl create -f https://docs.tigera.io/files/allow-ui-client.yaml\n")),(0,o.kt)("p",null,"After a few seconds, refresh the UI - it should now show the Services, but they should not be able to access each other any more."),(0,o.kt)("h3",{id:"4-create-the-backend-p

1olicyyaml-file-to-allow-traffic-from-the-frontend-to-the-backend"},"4) Create the backend-policy.yaml file to allow traffic from the frontend to the backend"),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-shell"},"kubectl create -f https://docs.tigera.io/files/backend-policy.yaml\n")),(0,o.kt)("p",null,"Refresh the UI. You should see the following:"),(0,o.kt)("ul",null,(0,o.kt)("li",{parentName:"ul"},"The frontend can now access the backend (on TCP port 6379 only)."),(0,o.kt)("li",{parentName:"ul"},"The backend cannot access the frontend at all."),(0,o.kt)("li",{parentName:"ul"},"The client cannot access the frontend, nor can it access the backend.")),(0,o.kt)("h3",{id:"5-expose-the-frontend-service-to-the-client-namespace"},"5) Expose the frontend service to the client namespace"),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-shell"},"kubectl create -f https://docs.tigera.io/files/frontend-policy.yaml\n")),(0,o.kt)("p",null,"The client can now access the frontend, but not the backend. Neither the frontend nor the backend\ncan initiate connections to the client. The frontend can still access the backend."),(0,o.kt)("p",null,"To use Calico to enforce egress policy on Kubernetes pods, see ",(0,o.kt)("a",{parentName:"p",href:"/calico/3.24/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced"},"the advanced policy demo"),"."),(0,o.kt)("h3",{id:"6-optional-clean-up-the-demo-environment"},"6) (Optional) Clean up the demo environment"),(0,o.kt)("p",null,"You can clean up the demo by deleting the demo Namespaces:"),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-bash"},"kubectl delete ns client stars management-ui\n")))}d.isMDXComponent=!0}}]);