Allow targeting nodes in CilumNetworkPolicy #19121
Description
Proposal / RFE
Cilium already supports a couple of methods to specify endpoints policies https://docs.cilium.io/en/stable/policy/language/#layer-3-examples.
Some Kubernetes constructs are supported too https://docs.cilium.io/en/stable/policy/kubernetes/.
In certain scenarios it can be useful to filter on nodes.
As an example, allowing egress from master nodes of a cluster to nodes that host ETCD proves to be difficult today.
Something like this might work if the IP adresses in the toCIDR statement are for nodes that belong to the cluster:
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: etcd
spec:
nodeSelector:
matchLabels:
node-role.kubernetes.io/control-plane: ''
ingress:
- fromEntities:
- kube-apiserver
toPorts:
- ports:
- port: '2379'
protocol: TCP
- port: '2380'
protocol: TCP
egress:
- toCIDR:
- 172.19.0.6/32
- 172.19.0.7/32
- 172.19.0.9/32
toPorts:
- ports:
- port: '2379'
protocol: TCP
- port: '2380'
protocol: TCPPolicy verdict log:
Policy verdict log: flow 0xa6c1d821 local EP ID 2007, remote ID kube-apiserver, proto 6, egress, action audit, match none, 172.19.0.7:57124 -> 172.19.0.9:2380 tcp SYN
Something like this will work if the kube-apiserver and ETCD run on the same nodes:
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: etcd
spec:
nodeSelector:
matchLabels:
node-role.kubernetes.io/control-plane: ''
ingress:
- fromEntities:
- kube-apiserver
toPorts:
- ports:
- port: '2379'
protocol: TCP
- port: '2380'
protocol: TCP
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: '2379'
protocol: TCP
- port: '2380'
protocol: TCPAlthough this is quite confusing as one would expect this to NOT work as the destination is definitely not targeting kube-apiserver.
Describe the solution you'd like
It would be nice to be able to use node selector in policy rules.
Something along those lines:
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: etcd
spec:
nodeSelector:
matchLabels:
node-role.kubernetes.io/control-plane: ''
ingress:
- fromEntities:
- kube-apiserver
toPorts:
- ports:
- port: '2379'
protocol: TCP
- port: '2380'
protocol: TCP
egress:
# select nodes based on node labels
- toNodes:
- matchLabels:
node-role.kubernetes.io/etcd: ''
toPorts:
- ports:
- port: '2379'
protocol: TCP
- port: '2380'
protocol: TCPSee original slack discussion https://cilium.slack.com/archives/C01JALNQAR1/p1647017730769119 too