This topic explains how to use Kubernetes network policies to secure Cassandra and Redis pods within an Apigee Hybrid Cluster .
Overview
When you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you can use Kubernetes Network Policies for applications in your cluster. Network Policies are an application-centric construct you can use to specify how a pod is allowed to communicate with other pods in your cluster.
In Apigee hybrid you can use Kubernetes Network Policies to isolate Cassandra pods so that only pods that are intended to communicate with Cassandra are allowed to, such as the Runtime, Synchronizer, and Mart pods. Other pods in the cluster like Ingres and Watcher pods that do not need to communicate with Cassandra are blocked from doing so.
If you have no restrictions on which pods can interact within your cluster, you do not need to use Kubernetes network policies.
Prerequisites
-
Enable network policies in your cluster.
- GKE: See Enabling network policy enforcement.
- EKS: See Installing the Calico network policy engine add-on.
- AKS: See Secure traffic between pods using network policies in Azure Kubernetes Service (AKS) .
- Other platforms: look for instructions to enable network policies on your cluster from your specific platform vendor.
- A currently running Apigee hybrid cluster, version 1.8 or newer.
Procedure
Download and extract the apigeectl
release package.
Linux
curl -LO \ https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_linux_64.tar.gz
Mac OS
curl -LO \ https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_mac_64.tar.gz
Windows
curl -LO ^ https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.11.2/apigeectl_windows_64.zip
The configuration files for the Kubernetes network policies for Cassandra and Redis are in the
following directory structure within the apigeectl
directory:
└── apigeectl └── examples └── network-policies └── securing-cassandra-redis-pods ├── README.md ├── base │ └── cluster-scoped-communication │ ├── cassandra │ │ ├── kustomization.yaml │ │ ├── networkpolicy-cassandra-allow-controller.yaml │ │ ├── networkpolicy-cassandra-allow-intranode.yaml │ │ ├── networkpolicy-cassandra-allow-mart.yaml │ │ ├── networkpolicy-cassandra-allow-runtime.yaml │ │ ├── networkpolicy-cassandra-alow-sync.yaml │ │ ├── networkpolicy-cassandra-create-user.yaml │ │ ├── networkpolicy-cassandra-monitoring.yaml │ │ └── networkpolicy-cassandra-remove-dc.yaml │ └── redis │ ├── kustomization.yaml │ ├── networkpolicy-redis-envoy.yaml │ └── networkpolicy-redis.yaml └── overlays └── ORG_NAME └── kustomization.yaml
Where ORG_NAME
is the name of your Apigee organization.
- Label the namespace with the following command:
kubectl label namespace APIGEE_NAMESPACE app=apigee
- Apply the network policies with the following command:
kubectl apply -k ${APIGEECTL_HOME}/examples/network-policies/securing-cassandra-redis-pods/overlays/ORG_NAME
- Validate that the network policies were applied with the following command:
kubectl get netpol -n APIGEE_NAMESPACE
The following network policies should be created in the APIGEE_NAMESPACE namespace:
NAME POD-SELECTOR AGE cassandra-from-mart app=apigee-cassandra 4d5h cassandra-from-runtime app=apigee-cassandra 4d5h cassandra-from-sync app=apigee-cassandra 4d5h cassandra-to-cassandra app=apigee-cassandra 4d5h controller-to-cassandra app=apigee-cassandra 4d5h redis-from-redisenvoy app=apigee-redis 3d18h redisenvoy-from-runtime app=apigee-redis-envoy 3d18h