Add Calico and Cilium Network Policy samples

policies/calico/calico-policy-tutorial/00-install-calicoctl.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/operations/calicoctl/install
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# calicoctl is the command line interface used to manage Calico resources such as
+# GlobalNetworkPolicy and the projectcalico.org/v3 NetworkPolicy used in this tutorial.
+
+# Variables
+CALICOCTL_VERSION=$(curl -s https://api.github.com/repos/projectcalico/calico/releases/latest | grep -oP '"tag_name": "\K(.*)(?=")')
+CLI_ARCH=amd64
+
+# Detect the CPU architecture so the correct calicoctl binary is downloaded
+if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
+
+# Download the calicoctl binary for the latest release and the detected architecture
+curl -L --fail --remote-name https://github.com/projectcalico/calico/releases/download/${CALICOCTL_VERSION}/calicoctl-linux-${CLI_ARCH}
+
+# Make the binary executable and move it onto the PATH
+chmod +x calicoctl-linux-${CLI_ARCH}
+sudo mv calicoctl-linux-${CLI_ARCH} /usr/local/bin/calicoctl
+
+# Verify the installation
+calicoctl version

policies/calico/calico-policy-tutorial/01-deploy-demo.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+# https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-policy-advanced
+
+# Variables
+namespace="advanced-policy-demo"
+template="demo.yaml"
+
+# Deploy the demo workloads (namespace, NGINX deployment + service, and the
+# busybox "access" pod). The namespace is declared in the manifest itself.
+kubectl apply -f $template
+
+# Wait for the workloads to be ready before running the connectivity checks
+kubectl wait --namespace $namespace --for=condition=Available deployment/nginx --timeout=120s
+kubectl wait --namespace $namespace --for=condition=Ready pod/access --timeout=120s
+
+# Check the status of the pods and services
+kubectl get pods,svc -n $namespace

policies/calico/calico-policy-tutorial/02-verify-access-allowed.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Before any policy is applied, all ingress and egress traffic is allowed.
+# From the "access" pod both the in-cluster NGINX service and the public internet
+# (google.com) should be reachable.
+
+# Variables
+namespace="advanced-policy-demo"
+
+# Access the NGINX service by name (in-cluster). Expected: NGINX welcome page HTML.
+echo "Testing access -> nginx (expected: ALLOWED)"
+kubectl exec -n $namespace access -- wget -q --timeout=5 nginx -O - | head -5
+
+# Access the public internet. Expected: google.com home page HTML.
+echo "Testing access -> google.com (expected: ALLOWED)"
+kubectl exec -n $namespace access -- wget -q --timeout=5 google.com -O - | head -5

policies/calico/calico-policy-tutorial/03-create-default-deny-policy.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Variables
+template="default-deny.yaml"
+
+# Apply the default-deny GlobalNetworkPolicy to lock down all ingress and egress
+# traffic for every namespace except kube-system, calico-system and calico-apiserver.
+# GlobalNetworkPolicy is a Calico v3 resource, so it is applied with calicoctl.
+calicoctl apply --allow-version-mismatch -f $template 2>/dev/null

policies/calico/calico-policy-tutorial/04-verify-access-denied.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# With the default-deny GlobalNetworkPolicy in place, all traffic that is not
+# explicitly allowed is now blocked. From the "access" pod neither the NGINX
+# service nor the public internet should be reachable.
+#
+# DNS resolution itself is blocked too, so name lookups fail with "bad address"
+# rather than a timeout.
+
+# Variables
+namespace="advanced-policy-demo"
+
+# Access the NGINX service by name. Expected: wget: bad address 'nginx'
+echo "Testing access -> nginx (expected: bad address 'nginx')"
+kubectl exec -n $namespace access -- wget -q --timeout=5 nginx -O - | head -5
+
+# Access the public internet. Expected: wget: bad address 'google.com'
+echo "Testing access -> google.com (expected: bad address 'google.com')"
+kubectl exec -n $namespace access -- wget -q --timeout=5 google.com -O - | head -5

policies/calico/calico-policy-tutorial/05-create-allow-busybox-egress-policy.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Variables
+template="allow-busybox-egress.yaml"
+
+# Apply a namespaced Calico NetworkPolicy that allows all egress traffic from the
+# busybox "access" pod (run=access), overriding the default-deny for egress on
+# that pod. Applied with calicoctl because it is a projectcalico.org/v3 resource.
+calicoctl apply --allow-version-mismatch -f $template 2>/dev/null

policies/calico/calico-policy-tutorial/06-verify-egress-allowed.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Egress from the "access" pod is now allowed, so the public internet is reachable.
+# However the NGINX service is still NOT reachable: although egress from "access"
+# is permitted, the default-deny still blocks ingress to the NGINX pod (which we
+# open up in the next step).
+
+# Variables
+namespace="advanced-policy-demo"
+
+# Access the public internet. Expected: google.com home page HTML (ALLOWED).
+echo "Testing access -> google.com (expected: ALLOWED)"
+kubectl exec -n $namespace access -- wget -q --timeout=5 google.com -O - | head -5
+
+# Access the NGINX service. Expected: wget: download timed out (ingress still denied).
+echo "Testing access -> nginx (expected: DENIED - ingress to nginx not yet allowed)"
+kubectl exec -n $namespace access -- wget -q --timeout=5 nginx -O - | head -5

policies/calico/calico-policy-tutorial/07-create-allow-nginx-ingress-policy.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Variables
+template="allow-nginx-ingress.yaml"
+
+# Apply a namespaced Calico NetworkPolicy that allows ingress to the NGINX pods
+# (app=nginx) from the "access" pod (run=access). Applied with calicoctl because
+# it is a projectcalico.org/v3 resource.
+calicoctl apply --allow-version-mismatch -f $template 2>/dev/null

policies/calico/calico-policy-tutorial/08-verify-ingress-allowed.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Both policies are now in place: egress from "access" is allowed and ingress to
+# NGINX from "access" is allowed. The "access" pod can therefore reach both the
+# NGINX service and the public internet, while all other traffic stays denied by
+# the default-deny GlobalNetworkPolicy.
+
+# Variables
+namespace="advanced-policy-demo"
+
+# Access the NGINX service. Expected: NGINX welcome page HTML (ALLOWED).
+echo "Testing access -> nginx (expected: ALLOWED)"
+kubectl exec -n $namespace access -- wget -q --timeout=5 nginx -O - | head -5
+
+# Access the public internet. Expected: google.com home page HTML (ALLOWED).
+echo "Testing access -> google.com (expected: ALLOWED)"
+kubectl exec -n $namespace access -- wget -q --timeout=5 google.com -O - | head -5

policies/calico/calico-policy-tutorial/09-get-policies.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Variables
+namespace="advanced-policy-demo"
+
+# List the global (non-namespaced) default-deny policy
+echo "GlobalNetworkPolicy:"
+calicoctl get globalnetworkpolicy -o wide
+
+# List the namespaced Calico NetworkPolicies in the demo namespace
+echo "NetworkPolicy in namespace [$namespace]:"
+calicoctl get networkpolicy -n $namespace -o wide
+
+# Show the full YAML definition of the default-deny global policy
+echo "default-deny definition:"
+calicoctl get globalnetworkpolicy default-deny -o yaml

policies/calico/calico-policy-tutorial/10-cleanup.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+
+# Variables
+namespace="advanced-policy-demo"
+
+# Delete the namespaced Calico NetworkPolicies
+calicoctl delete networkpolicy allow-busybox-egress -n $namespace
+calicoctl delete networkpolicy allow-nginx-ingress -n $namespace
+
+# Delete the global default-deny policy (gnp is the short name for GlobalNetworkPolicy)
+calicoctl delete gnp default-deny
+
+# Delete the demo namespace and all the workloads it contains
+kubectl delete ns $namespace

policies/calico/calico-policy-tutorial/allow-busybox-egress.yaml

@@ -0,0 +1,27 @@
+# Allow all egress traffic from the busybox "access" pod.
+#
+# This is a namespaced Calico NetworkPolicy (projectcalico.org/v3). It selects the
+# pod labelled run=access and permits all of its outbound (Egress) connections,
+# overriding the default-deny for egress on that pod only.
+#
+# For a production workload you would normally make this rule far more restrictive
+# and only allow egress to the specific destinations the workload needs. Because
+# this is just a probe pod, we allow all egress so we can explore what is reachable.
+#
+# Note: allowing egress from "access" lets it reach the internet (e.g. google.com),
+# but it still cannot reach the NGINX pod until ingress to NGINX is allowed too
+# (see allow-nginx-ingress.yaml).
+#
+# For more information, see:
+# https://docs.tigera.io/calico/latest/reference/resources/networkpolicy
+apiVersion: projectcalico.org/v3
+kind: NetworkPolicy
+metadata:
+  name: allow-busybox-egress
+  namespace: advanced-policy-demo
+spec:
+  selector: run == 'access'
+  types:
+    - Egress
+  egress:
+    - action: Allow

policies/calico/calico-policy-tutorial/allow-nginx-ingress.yaml

@@ -0,0 +1,26 @@
+# Allow ingress traffic to NGINX from the busybox "access" pod.
+#
+# This namespaced Calico NetworkPolicy (projectcalico.org/v3) selects the NGINX
+# pods (app=nginx) and permits inbound (Ingress) connections, but only from pods
+# labelled run=access. This punches a hole in the default-deny for ingress to
+# NGINX, scoped to the "access" pod as the source.
+#
+# Combined with allow-busybox-egress.yaml (egress from access) this completes the
+# path: the access pod can now reach the NGINX service, while everything else
+# remains denied by the default-deny GlobalNetworkPolicy.
+#
+# For more information, see:
+# https://docs.tigera.io/calico/latest/reference/resources/networkpolicy
+apiVersion: projectcalico.org/v3
+kind: NetworkPolicy
+metadata:
+  name: allow-nginx-ingress
+  namespace: advanced-policy-demo
+spec:
+  selector: app == 'nginx'
+  types:
+    - Ingress
+  ingress:
+    - action: Allow
+      source:
+        selector: run == 'access'

policies/calico/calico-policy-tutorial/default-deny.yaml

@@ -0,0 +1,25 @@
+# Default-deny GlobalNetworkPolicy.
+#
+# This is a Calico-only resource (it has no Kubernetes NetworkPolicy equivalent):
+# a GlobalNetworkPolicy is NOT namespaced and applies to every pod that matches
+# the selector across the whole cluster. A single Kubernetes NetworkPolicy would
+# have to be recreated in every namespace to achieve the same effect.
+#
+# It implements a zero-trust posture: once applied, any Ingress or Egress traffic
+# that is not explicitly allowed by another policy is denied.
+#
+# The kube-system, calico-system and calico-apiserver namespaces are excluded so
+# the default deny does not break Kubernetes itself or Calico's own components.
+#
+# For more information, see:
+# https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy
+# https://docs.tigera.io/calico/latest/network-policy/adopt-zero-trust
+apiVersion: projectcalico.org/v3
+kind: GlobalNetworkPolicy
+metadata:
+  name: default-deny
+spec:
+  selector: projectcalico.org/namespace not in {'kube-system', 'calico-system', 'calico-apiserver'}
+  types:
+    - Ingress
+    - Egress

policies/calico/calico-policy-tutorial/demo.yaml

@@ -0,0 +1,74 @@
+# This manifest deploys the demo workloads used by the Calico policy tutorial:
+#   - the advanced-policy-demo namespace
+#   - a plain NGINX deployment and ClusterIP service listening on port 80
+#   - a long-running busybox "access" pod used to probe connectivity
+#
+# The tutorial normally creates the NGINX deployment with imperative kubectl
+# commands and runs an interactive busybox pod. Here we declare everything as
+# manifests, and keep the busybox pod alive with a sleep loop so the connectivity
+# checks can be run non-interactively with "kubectl exec".
+#
+# For more information, see:
+# https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-policy-tutorial
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: advanced-policy-demo
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  namespace: advanced-policy-demo
+  labels:
+    app: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        # The "app == 'nginx'" Calico selector in allow-nginx-ingress.yaml
+        # matches this label.
+        app: nginx
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+          ports:
+            - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  namespace: advanced-policy-demo
+  labels:
+    app: nginx
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 80
+  selector:
+    app: nginx
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: access
+  namespace: advanced-policy-demo
+  labels:
+    # The "run == 'access'" Calico selector used by the egress and ingress
+    # policies matches this label.
+    run: access
+spec:
+  containers:
+    - name: access
+      image: busybox
+      # Keep the pod running so it can be used to test policy access with
+      # "kubectl exec" throughout the tutorial.
+      command: ["sh", "-c", "sleep infinity"]

policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# For more information, see https://docs.cilium.io/en/latest/gettingstarted/k8s-install-default/#install-the-cilium-cli
+
+CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt)
+CLI_ARCH=amd64
+if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
+curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
+sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
+sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
+rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
+
+HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt)
+HUBBLE_ARCH=amd64
+if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi
+curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}
+sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum
+sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin
+rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}