Using Network Policy in CCE Cluster
Updated at：2025-10-27
NetworkPolicy is a Kubernetes (K8s) resource used to define pod-based network isolation rules. It determines whether a group of pods can communicate with other pod groups or endpoints. This document primarily illustrates how to enable the NetworkPolicy function in CCE using the open-source tool kube-router.
kube-router
kube-router is a container network solution for Kubernetes. Its official website and code repository are as follows:
- Official website:https://www.kube-router.io
- Project:https://github.com/cloudnativelabs/kube-router
kube-router has three core functions:
- Pod Networking；
- IPVS/LVS based service proxy；
- Network Policy Controller.
CCE has its own container network implementation. This document focuses on using kube-router’s Network Policy Controller function.
Deploy kube-router
To deploy kube-router on a CCE K8S cluster, use the following YAML configuration:
Plain Text
1apiVersion: v1
2kind: ConfigMap
3metadata:
4 name: kube-router-cfg
5 namespace: kube-system
6 labels:
7 tier: node
8 k8s-app: kube-router
9data:
10 cni-conf.json: |
11 {
12 "name":"kubernetes",
13 "type":"bridge",
14 "bridge":"kube-bridge",
15 "isDefaultGateway":true,
16 "ipam": {
17 "type":"host-local"
18 }
19 }
20---
21apiVersion: extensions/v1beta1
22kind: DaemonSet
23metadata:
24 name: kube-router
25 namespace: kube-system
26 labels:
27 k8s-app: kube-router
28spec:
29 template:
30 metadata:
31 labels:
32 k8s-app: kube-router
33 annotations:
34 scheduler.alpha.kubernetes.io/critical-pod: ''
35 spec:
36 containers:
37 - name: kube-router
38 image: docker.io/cloudnativelabs/kube-router
39 args: ["--run-router=false", "--run-firewall=true", "--run-service-proxy=false", "--kubeconfig=/root/.kube/config"]
40 securityContext:
41 privileged: true
42 imagePullPolicy: Always
43 env:
44 - name: NODE_NAME
45 valueFrom:
46 fieldRef:
47 fieldPath: spec.nodeName
48 livenessProbe:
49 httpGet:
50 path: /healthz
51 port: 20244
52 initialDelaySeconds: 10
53 periodSeconds: 3
54 volumeMounts:
55 - name: lib-modules
56 mountPath: /lib/modules
57 readOnly: true
58 - name: cni-conf-dir
59 mountPath: /etc/cni/net.d
60 - name: kubeconfig
61 mountPath: /root/.kube/config
62 readOnly: true
63 initContainers:
64 - name: install-cni
65 image: busybox
66 imagePullPolicy: Always
67 command:
68 - /bin/sh
69 - -c
70 - set -e -x;
71 if [ ! -f /etc/cni/net.d/10-kuberouter.conf ]; then
72 TMP=/etc/cni/net.d/.tmp-kuberouter-cfg;
73 cp /etc/kube-router/cni-conf.json ${TMP};
74 mv ${TMP} /etc/cni/net.d/10-kuberouter.conf;
75 fi
76 volumeMounts:
77 - name: cni-conf-dir
78 mountPath: /etc/cni/net.d
79 - name: kube-router-cfg
80 mountPath: /etc/kube-router
81 hostNetwork: true
82 tolerations:
83 - key: CriticalAddonsOnly
84 operator: Exists
85 - effect: NoSchedule
86 key: node-role.kubernetes.io/master
87 operator: Exists
88 - effect: NoSchedule
89 key: node.kubernetes.io/not-ready
90 operator: Exists
91 volumes:
92 - name: lib-modules
93 hostPath:
94 path: /lib/modules
95 - name: cni-conf-dir
96 hostPath:
97 path: /etc/cni/net.d
98 - name: kube-router-cfg
99 configMap:
100 name: kube-router-cfg
101 - name: kubeconfig
102 hostPath:
103 path: /root/.kube/configExample demonstration
1. Create namespaces
Plain Text
1$kubectl create namespace production
2$kubectl create namespace staging2. Deploy the Nginx service
Create an Nginx deployment in different namespaces.
Plain Text
1$kubectl apply -f nginx.yaml --namespace=production
2$kubectl apply -f nginx.yaml --namespace=stagingYAML for nginx.yaml:
Plain Text
1apiVersion: extensions/v1beta1
2kind: Deployment
3metadata:
4 name: nginx-deployment
5 labels:
6 app: nginx
7spec:
8 replicas: 3
9 selector:
10 matchLabels:
11 app: nginx
12 template:
13 metadata:
14 labels:
15 app: nginx
16 spec:
17 containers:
18 - name: nginx
19 image: hub.baidubce.com/cce/nginx-alpine-go:latest
20 ports:
21 - containerPort: 80Verify pod startup:
Plain Text
1# staging environment
2$kubectl get pods -n staging
3NAME READY STATUS RESTARTS AGE
4nginx-deployment-7fbd5f4c55-2xgd4 1/1 Running 0 45s
5nginx-deployment-7fbd5f4c55-5xr75 1/1 Running 0 45s
6nginx-deployment-7fbd5f4c55-fn6lr 1/1 Running 0 20m
7
8# production environment
9$kubectl get pods -n production
10NAME READY STATUS RESTARTS AGE
11nginx-deployment-7fbd5f4c55-m764f 1/1 Running 0 10s
12nginx-deployment-7fbd5f4c55-pdhhz 1/1 Running 0 10s
13nginx-deployment-7fbd5f4c55-r98w5 1/1 Running 0 20mWhen no NetworkPolicy is set, all pods can communicate with each other. You can directly ping the IP of any pod to test connectivity.
NetworkPolicy policy testing
1. Default deny all ingress traffic
Block access to pods in the staging namespace.
Plain Text
1apiVersion: networking.k8s.io/v1
2kind: NetworkPolicy
3metadata:
4 name: default-deny
5 namespace: staging
6spec:
7 podSelector: {}
8 policyTypes:
9 - IngressExplanation of key fields:
- podSelector: Selects the pods to be isolated;
- policyTypes: Defines the policy type. NetworkPolicy differentiates traffic into ingress (incoming) and egress (outgoing). If not specified, no restrictions apply.
- ingress: Defines an allow list for inbound traffic. Requires specifying from (traffic source) and ports (destination locations). from supports three types: ipBlock, namespaceSelector, and podSelector;
- egress: Defines an outbound traffic allowlist. Like ingress, egress requires specifying traffic destinations ("to") and destination ports.
After creating the above NetworkPolicy, try accessing the IP of any pod in namespace=staging from another pod (e.g., a pod in the production namespace):
Plain Text
1$kubectl exec -it nginx-deployment-7fbd5f4c55-m764f /bin/sh -n production
2/ # ping 172.16.0.92
3PING 172.16.0.92 (172.16.0.92): 56 data bytes2. Default allow all ingress traffic
Allow access to pods in the staging namespace.
Plain Text
1apiVersion: networking.k8s.io/v1
2kind: NetworkPolicy
3metadata:
4 name: allow-all
5 namespace: staging
6spec:
7 podSelector: {}
8 ingress:
9 - {}
10 policyTypes:
11 - Ingress3. Default deny all egress traffic
Block outbound traffic from pods in the production namespace.
Plain Text
1apiVersion: networking.k8s.io/v1
2kind: NetworkPolicy
3metadata:
4 name: default-deny
5 namespace: production
6spec:
7 podSelector: {}
8 policyTypes:
9 - Egress4. Default allow all egress traffic
Allow outbound traffic from pods in the production namespace.
Plain Text
1apiVersion: networking.k8s.io/v1
2kind: NetworkPolicy
3metadata:
4 name: allow-all
5 namespace: production
6spec:
7 podSelector: {}
8 egress:
9 - {}
10 policyTypes:
11 - Egress5. Default deny all ingress and all egress traffic
Block all inbound and outbound traffic for all pods:
Plain Text
1apiVersion: networking.k8s.io/v1
2kind: NetworkPolicy
3metadata:
4 name: default-deny
5spec:
6 podSelector: {}
7 policyTypes:
8 - Ingress
9 - Egress