to secure access to and from external services, tradi�onal CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from applica�on containers to par�cular [h�ps://kubernetes.io/docs/concepts/overview/working-with- objects/labels/], Ingress [h�ps://kubernetes.io/docs/concepts/services- networking/ingress/], Service [h�ps://kubernetes.io/docs/concepts/services- networking/service/] 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source: ENFORCEMENT ENFORCEMENT 108

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] Values=${infraID}-master-sg" | jq -r '.SecurityGroups[0].GroupId')" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs=

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] Values=${infraID}-master-sg" | jq -r '.SecurityGroups[0].GroupId')" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs=

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular Values=${infraID}-master-sg" | jq -r '.SecurityGroups[0].GroupId')" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs= [{GroupId=${worker_sg}},{GroupId=${master_sg}}]" \ --group-id "${worker_sg}" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs=

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4 namespace=default k8s:org=alliance Both ingress and egress policy enforcement is still disabled on all of these pods because no network policy has

...................45 4.5 Ingress Support ..........................................................................................................48 4.5.1 Ingress Use cases ................... abstraction called a “service,” or with an ingress-type resource. A service masks underlying pods/containers and instead represents them as a single entity. The ingress ©Rancher Labs 2017. All rights Reserved Kubernetes cluster • Rancher-ingress-controller will leverage the existing Kubernetes load balancing functionality within Rancher and convert what’s in the Kubernetes ingress to a load balancer in Rancher

|grep cattle • Ve r i f y t h at t h e r ol e s e x i s t : kubectl get role default-psp-role -n ingress-nginx kubectl get role default-psp-role -n cattle-system kubectl get clusterrole restricted-clusterrole le • Ve r i f y t h e b i n d i n gs ar e s e t c or r e c t l y : kubectl get rolebinding -n ingress-nginx default-psp-rolebinding kubectl get rolebinding -n cattle-system default-psp-rolebinding kubectl apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: default-psp-role namespace: ingress-nginx rules: - apiGroups: - extensions resourceNames: - default-psp resources: - podsecuritypolicies