Este tópico explica como usar as políticas de rede do Kubernetes para proteger os pods do Cassandra e do Redis
num cluster híbrido do Apigee .
Vista geral
Quando quiser controlar o fluxo de tráfego ao nível do endereço IP ou da porta (camada OSI 3 ou 4), pode usar políticas de rede do Kubernetes para aplicações no seu cluster. As políticas de rede são uma construção centrada na aplicação que pode usar para especificar como um pod tem autorização para comunicar com outros pods no seu cluster.
No Apigee hybrid, pode usar políticas de rede do Kubernetes para isolar pods do Cassandra, de modo que apenas os pods destinados a comunicar com o Cassandra tenham autorização para o fazer, como os pods do Runtime, do Synchronizer e do Mart. Outros pods no cluster, como os pods Ingres e Watcher, que não precisam de comunicar com o Cassandra, são impedidos de o fazer.
Se não tiver restrições sobre os pods que podem interagir no seu cluster, não precisa de usar políticas de rede do Kubernetes.
Os ficheiros de configuração das políticas de rede do Kubernetes para o Cassandra e o Redis encontram-se na seguinte estrutura de diretórios no diretório apigeectl:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eKubernetes Network Policies can be used within an Apigee Hybrid cluster to control traffic flow to Cassandra and Redis pods at the IP address or port level.\u003c/p\u003e\n"],["\u003cp\u003eBy implementing Network Policies, you can restrict communication to Cassandra pods, allowing only intended pods like Runtime, Synchronizer, and Mart to interact with them.\u003c/p\u003e\n"],["\u003cp\u003eNetwork Policies are not required if there are no restrictions for communication within pods of your cluster.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eapigeectl\u003c/code\u003e tool, available for Apigee hybrid versions 1.11 and older, contains the configuration files needed to set up network policies for Cassandra and Redis pods.\u003c/p\u003e\n"],["\u003cp\u003eThe network policies can be applied and validated using \u003ccode\u003ekubectl\u003c/code\u003e commands, ensuring the correct policies are implemented in the specified Apigee namespace.\u003c/p\u003e\n"]]],[],null,["# Configuring Kubernetes network policies\n\n| You are currently viewing version 1.13 of the Apigee hybrid documentation. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to use Kubernetes network policies to secure Cassandra and Redis pods\nwithin an Apigee Hybrid Cluster .\n\nOverview\n--------\n\n\nWhen you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then\nyou can use Kubernetes Network Policies for applications in your cluster. Network Policies are an\napplication-centric construct you can use to specify how a pod is allowed to communicate with\nother pods in your cluster.\n\n\nIn Apigee hybrid you can use Kubernetes Network Policies to isolate Cassandra pods so that only\npods that are intended to communicate with Cassandra are allowed to, such as the Runtime,\nSynchronizer, and Mart pods. Other pods in the cluster like Ingres and Watcher pods that do not\nneed to communicate with Cassandra are blocked from doing so.\n\n\nIf you have no restrictions on which pods can interact within your cluster, you do not need to\nuse Kubernetes network policies.\n\nPrerequisites\n-------------\n\n- Enable network policies in your cluster.\n - **GKE** : See [Enabling\n network policy enforcement](/kubernetes-engine/docs/how-to/network-policy#enabling_network_policy_enforcement).\n - **EKS** : See [Installing\n the Calico network policy engine add-on](https://docs.aws.amazon.com/eks/latest/userguide/calico.html).\n - **AKS** : See [Secure\n traffic between pods using network policies in Azure Kubernetes Service (AKS)](https://docs.microsoft.com/en-us/azure/aks/use-network-policies).\n - Other platforms: look for instructions to enable network policies on your cluster from your specific platform vendor.\n- A currently running Apigee hybrid cluster, version 1.8 or newer.\n\nProcedure\n---------\n\nDownload and extract the `apigeectl` release package.\n| **Note:** `apigeectl` is only supported for Apigee hybrid versions 1.11 and older. The following command will download the latest release of `apigeectl` for Apigee hybrid version 1.11.\n\n### Linux\n\n```\ncurl -LO \\\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_linux_64.tar.gz\n```\n\n### Mac OS\n\n```\ncurl -LO \\\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_mac_64.tar.gz\n```\n\n### Windows\n\n```\ncurl -LO ^\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_windows_64.zip\n```\n\n\nThe configuration files for the Kubernetes network policies for Cassandra and Redis are in the\nfollowing directory structure within the `apigeectl` directory: \n\n```scdoc\n └── apigeectl\n └── examples\n └── network-policies\n └── securing-cassandra-redis-pods\n ├── README.md\n ├── base\n │ └── cluster-scoped-communication\n │ ├── cassandra\n │ │ ├── kustomization.yaml\n │ │ ├── networkpolicy-cassandra-allow-controller.yaml\n │ │ ├── networkpolicy-cassandra-allow-intranode.yaml\n │ │ ├── networkpolicy-cassandra-allow-mart.yaml\n │ │ ├── networkpolicy-cassandra-allow-runtime.yaml\n │ │ ├── networkpolicy-cassandra-alow-sync.yaml\n │ │ ├── networkpolicy-cassandra-create-user.yaml\n │ │ ├── networkpolicy-cassandra-monitoring.yaml\n │ │ └── networkpolicy-cassandra-remove-dc.yaml\n │ └── redis\n │ ├── kustomization.yaml\n │ ├── networkpolicy-redis-envoy.yaml\n │ └── networkpolicy-redis.yaml\n └── overlays\n └── ORG_NAME\n └── kustomization.yaml\n```\n\nWhere \u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e is the name of your Apigee organization.\n\n1. Label the namespace with the following command: \n\n ```\n kubectl label namespace APIGEE_NAMESPACE app=apigee\n ```\n | **Note** : Note: You can use any namespace. `apigee` is the default namespace. If you use a different namespace, be sure to replace \u003cvar translate=\"no\"\u003eAPIGEE_NAMESPACE\u003c/var\u003e with the name of your namespace in the following commands.\n2. Apply the network policies with the following command: \n\n ```\n kubectl apply -k ${APIGEECTL_HOME}/examples/network-policies/securing-cassandra-redis-pods/overlays/ORG_NAME\n ```\n3. Validate that the network policies were applied with the following command: \n\n ```\n kubectl get netpol -n APIGEE_NAMESPACE\n ```\n\n\n The following network policies should be created in the \u003cvar translate=\"no\"\u003eAPIGEE_NAMESPACE\u003c/var\u003e namespace: \n\n ```text\n NAME POD-SELECTOR AGE\n cassandra-from-mart app=apigee-cassandra 4d5h\n cassandra-from-runtime app=apigee-cassandra 4d5h\n cassandra-from-sync app=apigee-cassandra 4d5h\n cassandra-to-cassandra app=apigee-cassandra 4d5h\n controller-to-cassandra app=apigee-cassandra 4d5h\n redis-from-redisenvoy app=apigee-redis 3d18h\n redisenvoy-from-runtime app=apigee-redis-envoy 3d18h\n \n ```"]]
