Policies for Kubernetes Nginx/Haproxy Ingress controller running as Deployment/Daemonset
Secure Workload will enforce policies both at the ingress controller and at the backend pods when the pods are exposed to the external clients using Kubernetes ingress object.
Following are the steps to enforce policies on Ingress controller.
Procedure
| 1 |
Create/Update an external orchestrator for Kubernetes/OpenShift using OpenAPI. See Orchestrators for infor- mation on creating the external orchestrator using OpenAPI. Add information of Ingress Controllers for External Orchestrator config. |
| 2 |
Create an ingress object in the Kubernetes cluster. |
| 3 |
Deploy Ingress controller in the Kubernetes cluster. |
| 4 |
Create a backend service which will be accessed by the consumers outside the cluster |
| 5 |
Create a policy between external consumer and backend service. |
| 6 |
When you are ready, enforce the policy. |
| 7 |
In case of Ingress controllers Secure Workload software will apply the appropriate allow/drop rule where the source will be consumer specified in the above step and destination will be corresponding Ingress controller pod IP. In case of backend pods, Secure Workload software will apply the appropriate allow/drop rule where the source will be Ingress pod and destination will be the backend pod IP. |