You are viewing documentation for KubeSphere version:v3.0.0

KubeSphere v3.0.0 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date documentation, see the latest version.

Last updated:

Edit

Feedback

Network Policies

What are Network Policies

Starting from v3.0.0, users can configure network policies of native Kubernetes in KubeSphere. Network Policies are an application-centric construct, enabling you to specify how a Pod is allowed to communicate with various network entities over the network. With network policies, users can achieve network isolation within the same cluster, which means firewalls can be set up between certain instances (Pods).

Note

Please make sure that the CNI network plugin used by the cluster supports Network Policies before you enable the feature. There are a number of CNI network plugins that support Network Policies, including Calico, Cilium, Kube-router, Romana and Weave Net.
It is recommended that you use Calico as the CNI plugin before you enable Network Policies.

For more information, see Network Policies.

Enable the Network Policy before Installation

Installing on Linux

When you implement multi-node installation of KubeSphere on Linux, you need to create a configuration file, which lists all KubeSphere components.

In the tutorial of Installing KubeSphere on Linux, you create a default file config-sample.yaml. Modify the file by executing the following command:
```
vi config-sample.yaml
```
Note

If you adopt All-in-One Installation, you do not need to create a config-sample.yaml file as you can create a cluster directly. Generally, the all-in-one mode is for users who are new to KubeSphere and look to get familiar with the system. If you want to enable the Network Policy in this mode (for example, for testing purposes), refer to the following section to see how the Network Policy can be installed after installation.
In this file, navigate to networkpolicy and change false to true for enabled. Save the file after you finish.
```
networkpolicy:
    enabled: true # Change "false" to "true"
```
Create a cluster using the configuration file:
```
./kk create cluster -f config-sample.yaml
```

Installing on Kubernetes

The process of installing KubeSphere on Kubernetes is same as stated in the tutorial of Installing KubeSphere on Kubernetes except the optional component Network Policy needs to be enabled first in the cluster-configuration.yaml file.

Download the file cluster-configuration.yaml and open it for editing.
```
vi cluster-configuration.yaml
```
In this local cluster-configuration.yaml file, navigate to networkpolicy and enable it by changing false to true for enabled. Save the file after you finish.
```
networkpolicy:
    enabled: true # Change "false" to "true"
```

Execute the following commands to start installation:

kubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.0.0/kubesphere-installer.yaml

kubectl apply -f cluster-configuration.yaml

Enable the Network Policy after Installation

Log in to the console as admin. Click Platform in the top-left corner and select Clusters Management.
Click CRDs and enter clusterconfiguration in the search bar. Click the result to view its detail page.

Info

A Custom Resource Definition (CRD) allows users to create a new type of resources without adding another API server. They can use these resources like any other native Kubernetes objects.
In Resource List, click the three dots on the right of ks-installer and select Edit YAML.
In this yaml file, navigate to networkpolicy and change false to true for enabled. After you finish, click Update in the bottom-right corner to save the configuration.
```
networkpolicy:
    enabled: true # Change "false" to "true"
```
You can use the web kubectl to check the installation process by executing the following command:
```
kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l app=ks-install -o jsonpath='{.items[0].metadata.name}') -f
```
Tip

You can find the web kubectl tool by clicking the hammer icon in the bottom-right corner of the console.

Verify the Installation of the Component

If you can see Network Policies in Network as the image below, it means the installation succeeds as this part won’t display until you install the component.

networkpolicy

Previous : KubeSphere Service Mesh Next : Metrics Server Next

What’s on this Page