General network policy for namespaces
Disclosed herein is a system and method for controlling network traffic among namespaces in which various entities, such as virtual machines, pod virtual machines, and a container orchestration system, such as Kubernetes, reside and operate. The entities have access to a network that includes one or more firewalls. The traffic that is permitted to flow over the network among and between the namespaces is defined by a security policy definition. The security policy definition is posted to a master node in a supervisor cluster that supports and provisions the namespaces. The master node invokes a network manager to generate a set of firewall rules and program the one or more firewalls in the network to enforce the rules.
1 . A method for controlling network traffic among a plurality of namespaces, the method comprising:
creating a security policy definition describing allowed traffic on a network, the network including one or more firewalls, wherein one or more entities reside and operate in each namespace of the plurality of namespaces and have access to each other via the network; and
sending the security policy definition to a node that supports the plurality of namespaces, wherein the node sends the security policy definition to a network manager that formulates a set of rules for the one or more firewalls controlling the allowed traffic on the network according to the security policy definition, and
wherein the one or more firewalls enforce the set of rules controlling the allowed traffic on the network.
2 . The method of claim 1 , wherein the node supporting the plurality of namespaces is a master node in a Kubernetes cluster, the master node having an application programming interface that receives the security policy definition.
3 . The method of claim 1 , wherein the security policy definition includes a namespace and one or more of:
an ingress policy to the namespace;
an egress policy from the namespace; or
a network protocol for controlling the allowed traffic on the network.
4 . The method of claim 1 , wherein one of the entities of the one or more entities is a virtual machine residing in a first namespace, and another one of the entities is a pod virtual machine residing in a second namespace, and the security policy definition applies to the virtual machine and the pod virtual machine.
5 . The method of claim 1 , wherein one of the entities of the one or more entities is a pod virtual machine residing in a first namespace, and another one of the entities of the one or more entities is a Kubernetes cluster associated with a second namespace, and the security policy definition applies to the Kubernetes cluster and the pod virtual machine.
6 . The method of claim 1 , wherein the security policy definition includes a namespace and allows no traffic in or out of the namespace.
7 . The method of claim 1 , wherein one of the entities of the one or more entities is a load balancer service, and the security policy definition allows traffic only into and not out of the load balancer service.
8 . A system comprising:
a supervisor cluster having a master node and supporting a plurality of namespaces;
an entity residing and operating in each of the namespaces in the plurality of namespaces; and
a network providing access among each of the respective entities, the network including one or more firewalls;
wherein the master node is configured to:
receive a security policy definition describing allowed traffic on the network; and
send the security policy definition to a network manager that formulates a set of rules for the one or more firewalls controlling the allowed traffic on the network according to the security policy definition, wherein the one or more firewalls enforce the set of rules controlling the allowed traffic on the network.
9 . The system of claim 8 , wherein the master node has an application programming interface that receives the security policy definition.
10 . The system of claim 8 , wherein the security policy definition includes a namespace and one or more of:
an ingress policy to the namespace;
an egress policy from the namespace; or
a network protocol for controlling the allowed traffic on the network.
11 . The system of claim 8 , wherein one of the entities of the one or more entities is a virtual machine residing in a first namespace, and another one of the entities is a pod virtual machine residing in a second namespace, and the security policy definition applies to the virtual machine and the pod virtual machine.
12 . The system of claim 8 , wherein one of the entities of the one or more entities is a pod virtual machine residing in a first namespace, and another one of the entities of the one or more entities is a Kubernetes cluster associated with a second namespace, and the security policy definition applies to the Kubernetes cluster and the pod virtual machine.
13 . The system of claim 8 , wherein the security policy definition includes a namespace and allows no traffic in or out of the namespace.
14 . The system of claim 8 , wherein one of the entities of the one or more entities is a load balancer service, and the security policy definition allows traffic only into and not out of the load balancer service.
15 . A non-transitory computer-readable medium comprising instructions, which, when executed, cause a computer system to carry out a method for controlling network traffic among a plurality of namespaces, the method comprising:
creating a security policy definition describing allowed traffic on a network, the network including one or more firewalls, wherein one or more entities reside and operate in each namespace of the plurality of namespaces and have access to each other via the network; and sending the security policy definition to a node that supports the plurality of namespaces,
wherein the node sends the security policy definition to a network manager that formulates a set of rules for the one or more firewalls controlling the allowed traffic on the network according to the security policy definition, and
wherein the one or more firewalls enforce the set of rules controlling the allowed traffic on the network.
16 . The non-transitory computer-readable medium of claim 15 , wherein the node supporting the plurality of namespaces is a master node in a Kubernetes cluster, the master node having an application programming interface that receives the security policy definition.
17 . The non-transitory computer-readable medium of claim 15 , wherein the security policy definition includes a namespace and one or more of:
an ingress policy to the namespace;
an egress policy from the namespace, or
a network protocol for controlling the allowed traffic on the network.
18 . The non-transitory computer-readable medium of claim 15 , wherein one of the entities of the one or more entities is a pod virtual machine residing in a first namespace, and another one of the entities of the one or more entities is a Kubernetes cluster associated with a second namespace, and the security policy definition applies to the Kubernetes cluster and the pod virtual machine.
19 . The non-transitory computer-readable medium of claim 15 , wherein one of the entities is a pod virtual machine residing in a first namespace, and another one of the entities is a Kubernetes cluster associated with a second namespace, and the security policy definition applies to the Kubernetes cluster and the pod virtual machine.
20 . The non-transitory computer-readable medium of claim 15 , wherein one of the entities of the one or more entities is a load balancer service, and the security policy definition allows traffic only into and not out of the load balancer service.