How to Implement Micro-Segmentation in K8s Using Cilium Network Policies

Zero-Trust networking in Kubernetes demands enacting least-privilege communication. To achieve this, we must explicitly outline which services can interact, blocking all other traffic by default, all while keeping latency overhead in check. The answer lies in CiliumNetworkPolicy, an eBPF-powered solution.

Let's define a CiliumNetworkPolicy (CNP) to isolate a PostgreSQL database, permitting ingress traffic solely from authorized backend API pods over a designated port. Cilium enforces this policy directly within the Linux kernel using eBPF maps.

The policy YAML, tagged as kind: CiliumNetworkPolicy, outlines our micro-segmentation logic. The endpointSelector section identifies the target of the policy, assigning each matching pod a unique cryptographic identity. These identities are utilized by Cilium agents on each node to apply the policy to the eBPF programs attached to the veth interfaces of these specific pods.

The ingress section specifies the allow list. Only traffic originating from endpoints with the app=backend-api identity is permitted. Here, Cilium's identity-based approach shines, as it effortlessly adapts to pod churn without incessantly rewriting iptables rules. The toPorts section further refines the policy, restricting allowed traffic to the standard PostgreSQL port (5432) over TCP. This ensures even if an attacker compromises the backend API pod, they cannot probe the database pod on other ports like SSH (22).

By defaulting to a deny-all posture and explicitly permitting through CNPs, we establish a robust micro-segmented architecture. In this setup, the blast radius of any potential breach is strictly contained.