Available in editions:  Open/CE, BE, SE, SE+, Ultimate/EE, Core

The module lifecycle stage: General Availability

Do not use the module if the cilium module is enabled because it already has network policy management.

This module manages network policies.

Deckhouse implements a conservative approach to organizing the network based on elementary network backends, such as “pure” CNI or flannel in the host-gw mode. This approach is simple and reliable, and has proven itself to be the best.

The NetworkPolicy implementation in Deckhouse is also simple and reliable. It is based on kube-router in the Network Policy Controller mode (--run-firewall). In this case, kube-router transforms NetworkPolicy network policies into iptables rules that work in any installations (regardless of the cloud or the CNI used).

The network-policy-engine module deploys a d8-system DaemonSet in the namespace with kube-router in the Network Policy Controller mode. As a result, the Kubernetes cluster fully supports Network Policies.

The following policy description formats are supported:

  • networking.k8s.io/NetworkPolicy API
  • network policy V1/GA semantics
  • network policy beta semantics

Example recipes are available here.

Third-party components

List of third-party software used in the network-policy-engine module:

  • Kube-router 2.0.1

    License: Apache License 2.0

    A turnkey solution for Kubernetes networking with aim to provide operational simplicity and high performance.