Example recipe for isolating service namespaces ? about kubernetes-network-policy-recipes HOT 3 CLOSED

Agreed. There are some more details of course … for instance in the example recommendations you listed below, we would also need RBAC policies that prevent namespaxce users fro mchanging their network policies to over-ride this isolation … however at the same time we still need to allow them to create other network policies for isolating/ or non-isolating between different tiers of their application within a single namespace. So we need some types of network policies that are only configurable by the cluster admin or namespace admin and some that are also configurable by application developers/ normal users. Hence I was looking to see if someone has already done such an analysis and provided any suggested recommendations … if not, I would be happy to briefly discuss/ work with you or anyone interested in collaborating on this (and similarly there also issues with need for selective rbac and selective filtering when using day-N monitoring services running in special service namespaces). From: Ahmet Alp Balkan <[email protected]> Reply-To: ahmetb/kubernetes-network-policy-recipes <[email protected]> Date: Wednesday, September 19, 2018 at 4:58 PM To: ahmetb/kubernetes-network-policy-recipes <[email protected]> Cc: Sanjeev Rampal <[email protected]>, Author <[email protected]> Subject: Re: [ahmetb/kubernetes-network-policy-recipes] Example recipe for isolating service namespaces ? (#37) I agree this is more of a recommendation topic and not so much of a recipe. I recently gave a talk about Kubernetes multi-tenancy<https://ahmet.im/blog/google-cloud-next-18/> and here's what I recommended: 1. when you create a namespace "foo", apply the deny-all-ingress to all pods in "foo" 2. then, only whitelist the stuff that needs access to pods in "foo" 3. make sure you can automate (1) –for that we have "GKE Policy Management" feature. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#37 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AIL80Cy9n0DlP5kfHm25muqy_H_wkq1Lks5ucq_VgaJpZM4Ww2zX>.