Improving our applications’ security
In Kubernetes, application traffic flows freely by default. A flat network is deployed to cover Pod-to-Pod and Service-to-Pod communications – remember that containers within a Pod have a common, shared IP address. Pods running within a Kubernetes cluster will see each other, and it will require some extra work to protect one application from another, even if they run on different nodes and in different namespaces.
It may be strange to hear, but applications running in different namespaces can see each other. In fact, if they have an associated Service resource, it would be easy to use the internal DNS to resolve its associated IP address and access its processes.
In the next section, we will learn how NetworkPolicy resources can be used to define our applications’ communications and have Kubernetes block any unwanted connectivity for us.
Network policies
NetworkPolicy resources (also referred to as netpol) allow...
