<p><strong>Problem:</strong></p>

<p>Network policies with Kubernetes do not act as expected (egress &amp; ingress seem switched to me?) More importantly, I can't seem to lock down web traffic from accessing the /api/ route directly without also blocking the frontend.</p>

<p><strong>Code Setup:</strong></p>

<p>Frontend (React) that uses Axios to talk to the backend.  Setup as microservices and use Ingress to push around traffic appropriately based on the route.  External managed DB.</p>

<p><strong>Kubernetes Setup</strong></p>

<ul>
<li>Frontend Deployment and Service</li>
<li>API deployment and service</li>
<li>Ingress service that relies on http paths.</li>
<li>Externally managed DB outside the cluster.</li>
</ul>

<p><strong>Network Policy in question:</strong></p>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: api-blocking
spec:
  podSelector:
    matchLabels:
      component: api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - ipBlock:
            cidr: 111.111.111.0/32
      ports:
        - port: 98711
  egress:
    - to:
        - podSelector:
            matchLabels:
              component: frontend
      ports:
        - port: 3000
</code></pre>

<p>Allowing ingress traffic to a particular CIDR with a specific port number allows the db fetch to happen appropriately.  Allowing egress traffic to the frontend is what facilitates the frontend being able to grab backend data.</p>

<p>No combination of network policies though would prevent the user from going to /api/ to without it also collapsing the frontend. Hoping for a way to lock that down and only allow the specific client side pod to connect to the backend?  </p>

<p>....After typing this out, maybe I need a network policy for the ingress-service?? </p>

<p><strong>Update:</strong>
I attempted using a network plugin specific rule.</p>

<p>The way I wrote the rule was to allow only the "frontend" endpoint access /api/ http routes for both ingress and egress.  It didn't seem to block it off from web traffic hitting the API.</p>

<p>Example of a portion of it with placeholder values:</p>

<pre><code>ingress:
    - fromEndpoints:
        - matchLabels:
            component: frontend
      toPorts:
        - ports:
            - port: '1111'
          rules:
            http:
              - path: '/api/ping'
</code></pre>

dizzy
<blockquote>
  <p>I can't seem to lock down web traffic from accessing the /api/ route directly without also blocking the frontend.</p>
</blockquote>

<p>I don't think that is possible with the standard Network Policy object, as it's only allowing you to whitelist traffic based on <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors" rel="nofollow noreferrer">pods, namespaces and IPs</a>.</p>

<p>It seems to be possible to me more granular with <a href="https://docs.projectcalico.org/v3.7/reference/calicoctl/resources/networkpolicy" rel="nofollow noreferrer">Calico Network Policies</a> (check <code>for Application layer policy</code>).</p>
