Can I block connection between a pod and ElastiCache in AWS

Question

I have my K8s setup(Pods A,B and C) and Elastic cache ("xxx.xxxx.xx.cache.amazonaws.com")in AWS. Right now all my pods have access to elastic cache.

I am looking for a solution by which I can restrict the communication. I read about calico but I understand I can block communication between two pods. Is there any way I can allow A to communicate with xxx.xxxx.xx.cache.amazonaws.com but block Pods B and C.

PS: Elastice cache is not something reside inside the k8s cluster.

Arghya Sadhu · Accepted Answer · 2020-04-23T15:29:19.057

2

You can use Kubernetes network policy where you can define egress policy to allow/deny outgoing traffic to CIDR blocks or IPs from pods selected by a label.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
        except: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978

Above example blocks traffic to 10.0.0.0/24 on port 5978 from pods with label role: db

A network plugin such as calico is needed for it work. Follow docs to install calico in EKS cluster.

edited Apr 23 '20 at 15:29

answered Apr 23 '20 at 12:39

Arghya Sadhu

41,002
9
78
107

I should have calio to use networkpolicy in AWS EKS.? – Vikas Rathore Apr 23 '20 at 15:06
What is the CNI implementation you already have? Calico or something else? – Arghya Sadhu Apr 23 '20 at 15:09
amazon-k8s-cni:v1.5.3 – Vikas Rathore Apr 23 '20 at 15:12
I don't have anything extra. I just created my eks cluster. So do have to add calico or I can directly use network policy? – Vikas Rathore Apr 23 '20 at 15:14
Yes you need to install calico https://docs.aws.amazon.com/eks/latest/userguide/calico.html – Arghya Sadhu Apr 23 '20 at 15:17
I am stuck at the option I need to select for "xxx.xxxx.xx.cache.amazonaws.com". I guess there in no option dns name in calico network policy – Vikas Rathore Apr 28 '20 at 14:03
there is something called global network policy and also check Tigera enterprise may support dns – Arghya Sadhu Apr 28 '20 at 14:05

Can I block connection between a pod and ElastiCache in AWS

1 Answers1