Cilium Network Policy: CCA practice questions

Cilium enforces three families of policy resources. The standard Kubernetes NetworkPolicy covers layers 3 and 4 at a pod's ingress or egress. CiliumNetworkPolicy is a namespaced custom resource that reaches from layer 3 to layer 7 and exists to provide what NetworkPolicy does not yet support; its spec field holds one rule and specs holds a list. CiliumClusterwideNetworkPolicy has the same rule format without a namespace and additionally allows a node selector, so a rule can apply to nodes rather than only to pods. All of these are distributed to the agents automatically by Kubernetes.

The model is an allow list. Each rule permits the traffic it matches, overlapping rules permit the union, and anything not matched is dropped once enforcement is active for that endpoint and direction. When enforcement becomes active depends on the policy enforcement mode, set with the Helm value policyEnforcementMode or the agent flag enable-policy. In default mode an endpoint has unrestricted access until some policy selects it; a rule with an ingress section then puts it into default deny for ingress, and the same applies separately to egress. In always mode enforcement applies to every endpoint even if no rule selects it, so health checks may need explicit allowances. In never mode enforcement is off everywhere, even for selected endpoints.

Layer 3 rules identify peers in several ways. Endpoint selectors match pod labels through endpointSelector, fromEndpoints and toEndpoints, and because they work on identities the policy must allow the traffic on both sides, sender and receiver. Entities name well-known groups: host, remote-node, kube-apiserver, ingress, cluster, cluster-mesh, init, health, unmanaged, world (everything outside the cluster) and all. toServices refers to Kubernetes Services by name or label. CIDR rules are meant for peers not managed by Cilium and are described as a last resort because they need stable addresses.

DNS-based egress with toFQDNs uses matchName for an exact name or matchPattern for wildcards such as *.cilium.io. It only works with the layer 7 proxy enabled and a DNS rule in the same policy that allows the lookups, because Cilium learns the addresses by intercepting DNS responses in its DNS proxy. A toFQDNs rule cannot be combined with other layer 3 selectors in the same egress rule.

Layer 7 rules sit inside a toPorts entry, and one port can carry only one protocol type. HTTP rules match method, path, host and headers; DNS rules match query names. Traffic is sent through a node-local Envoy, and a violation does not drop packets: for HTTP the proxy returns 403 access denied, and for DNS it answers REFUSED. A request passes when at least one rule matches. Kubernetes ClusterNetworkPolicy, available from Cilium 1.20 when enabled, adds tiers whose admin rules take precedence over all of the above.