Verify Network Isolation is working as expected

[devdattakulkarni]

KubePlus creates a Network boundary using NetworkPolicy objects for each deployed application instance.
There are two NetworkPolicy objects created. One which restricts cross-namespace traffic.
Second which allows only traffic from outside world to reach the application namespace.
The implementation is here:
https://github.com/cloud-ark/kubeplus/blob/master/deploy/kubeconfiggenerator.py#L1106

Above Network policies are taken from the Network Policy recipes given here:
https://github.com/ahmetb/kubernetes-network-policy-recipes

Specifically:

• https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md
• https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/08-allow-external-traffic.md

This issue is to verify that the above NetworkPolicies really work for KubePlus-managed application instances.

In order to test the Network Policies, here are steps:

• On Minikube, first install a Network driver that is able to recognize NetworkPolicy objects (e.g.: cilium).
• Create HelloWorldService CRD
• Create two instances of HelloWorldService (hs1 and hs2).
• kubectl exec into hs1 and try to ping/curl app endpoints in hs2. This traffic should be denied
• kubectl exec into hs2 and try to ping/curl app endpoint in hs1. This should should be denied.
• Perform additional tests given on the above links.

Create a PR with any changes that need to be included in the NetworkPolicy implementation

[devdattakulkarni]

@SuyogShinde942 Can you take a look at this issue next?

[SuyogShinde942]

sure

[SuyogShinde942]

The cross network isolation is working as expected.

[devdattakulkarni]

@SuyogShinde942 Nice!!
What was the setup that you had to do? Which network driver did you install?

[devdattakulkarni]

@SuyogShinde942 I am thinking that we should document the exact steps inside the examples folder.
We can add a file (advanced-usecases.md). Add a link to this file towards the end of "getting-started.md"

[SuyogShinde942]

I followed the steps mentioned in the steps.txt for /examples/multitenancy/hello-world, To start the minikube with network driver i used command "minikube start --cni=cilium"

[devdattakulkarni]

Got it. To test network isolation, you also had to follow the steps listed above, right? And then the exec into Pod and curl commands? We should document all of this so that when others want to test it, they will know exactly what steps to follow. @SuyogShinde942

[SuyogShinde942]

sure, Should we create any other file for network isolation testing ?