Security boundaries in the network layer
A Kubernetes NetworkPolicy defines the rules for different groups of Pods that are allowed to communicate with each other. In the previous chapter, we briefly talked about the egress rule of a Kubernetes NetworkPolicy, which can be leveraged to enforce the principle of least privilege for microservices. In this section, we will go through a little more on the Kubernetes NetworkPolicy and will focus on the Ingress rule. Ingress controls dictate how external traffic reaches the Kubernetes cluster.
Ingress Resources are used to define HTTP/HTTPS entry points into the cluster. Secure and configure Ingress with TLS to encrypt traffic.
Ingress rules can be implemented in NetworkPolicies to specify which sources (IP addresses, namespaces, or Pods) can access workloads.
On the other hand, Egress controls define what external destinations workloads are allowed to communicate with: for example, they allow only connections with trusted IPs...
