<p>Is there a way in Kubernetes or there's a network plugin on which we can limit the range of IP allocation. For example, I am trying to use weave and using a subnet <code>192.168.16.0/24</code>. I want to limit the allocation of IPs through Kubernetes to pods to the range of <code>192.168.16.10</code>-<code>30</code>.</p>

<p>However, my app might use the rest of the IPs based on requirements i.e. my app can start a virtual IP from <code>192.168.16.31</code>-<code>50</code> but I want some mechanism to make sure that the IP range I specified will not be allocated by K8s and my app can consume that.</p>

<p>I need something like this: <a href="https://www.weave.works/docs/net/latest/tasks/ipam/configuring-weave/" rel="nofollow noreferrer">https://www.weave.works/docs/net/latest/tasks/ipam/configuring-weave/</a>.</p>

drifter
<h1><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource" rel="nofollow noreferrer">Network Policy</a> resource will help</h1>

<p>See <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource" rel="nofollow noreferrer">Documentation</a></p>

<blockquote>
  <p>An example NetworkPolicy might look like this:</p>
  
  <pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
    - namespaceSelector:
        matchLabels:
          project: myproject
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978
</code></pre>
</blockquote>

<p>The rule <code>ipBlock</code> describes the network ranges for <code>ingress</code> and <code>egress</code> rules.
E.g.:</p>

<pre><code>    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
</code></pre>

<h1>CIDR</h1>

<p>CIDR stands for <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing" rel="nofollow noreferrer">Classless Inter-Domain Routing</a>, see <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#IPv4_CIDR_blocks" rel="nofollow noreferrer">samples of IPv4 CIDR blocks</a></p>

<h1>More info</h1>

<ul>
<li>For more info see the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#networkpolicy-v1-networking-k8s-io" rel="nofollow noreferrer">NetworkPolicy reference</a>.</li>
<li>Also, you can check great <a href="https://medium.com/@reuvenharrison/an-introduction-to-kubernetes-network-policies-for-security-people-ba92dd4c809d" rel="nofollow noreferrer">intro to <code>k8s</code> networking</a> by <a href="https://medium.com/@reuvenharrison" rel="nofollow noreferrer">Reuven Harrison</a></li>
</ul>
