kubero-dev / kubero-dev/kubero

Integrate network policy management

Open
#225 0 comments 2 reactions 1 assignee Claimed by @mms-gianni View on GitHub
feature Idea/discussion Operator
Dominant language
TypeScript
Stars
4.4k
Forks
213
PR merge metrics
No merged PRs in 30d

Description

For security resons it would be great to integrate network policies to limit network connections only between allowed services.

Let's see an example:
let's assume we have an application composed of
- a **front-end web application** (ex. Nuxt.js or Nodejs server with Express) that will give a web representation of the data fetched by the back-end API
- a **back-end API** (ex. a Go application) that will read and interact with the data
- a **local Redis** service
- a **shared Mysql** service (shared between different projects as Mysql scales better if you have one global instance instead of multiple separated ones)

Now the **front-end App** should be contacted only by the ingress and can only contact the **back-end API**.
The **back-end API** should be contacted only by the **front-end App** but can connect to the **local Redis** and **shared Mysql** instances.
The **shared Mysql** instances may be contacted by multiple services in various projects while the other services are only available inside the pipeline/stage and cannot be accessed anywhere else (except from the web ingress).

Creating egress/ingress rules allows limiting access from ingoing and outgoing traffic where not allowed; let's say for example that the **front-end web application** get compromised:
in a normal kubernete system the attacker may try to reach other services in the cluster (ex: a not so well secured internal services that may contain critical data, only secured by "not opening any port to the public" ); by applying those rules the attacher may only reach the **back-end API** and cannot reach in any way non essential services.

To convert this into an UI/UX feature i propose to block by default (maybe adding also a checkbox to disable this feature?) all the traffic that is not "linked" to the service as an add-on or as a "linked service" from another pipeline (in this example the global Mysql service, other services may include Mail services, etc.).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.