Questo argomento spiega come utilizzare i criteri di rete di Kubernetes per proteggere i pod Cassandra e Redis all'interno di un cluster Apigee Hybrid .
Panoramica
Quando vuoi controllare il flusso di traffico a livello di indirizzo IP o porta (livello OSI 3 o 4), puoi utilizzare i criteri di rete Kubernetes per le applicazioni nel tuo cluster. I criteri di rete sono un costrutto incentrato sulle applicazioni che puoi utilizzare per specificare in che modo un pod puรฒ comunicare con altri pod nel cluster.
In Apigee Hybrid puoi utilizzare i criteri di rete di Kubernetes per isolare i pod Cassandra in modo che solo i pod destinati a comunicare con Cassandra possano farlo, ad esempio i pod Runtime, Synchronizer e Mart. Altri pod del cluster, come i pod Ingres e Watcher, che non devono comunicare con Cassandra, non possono farlo.
Se non hai limitazioni sui pod che possono interagire all'interno del cluster, non devi utilizzare i criteri di rete Kubernetes.
I file di configurazione per i criteri di rete di Kubernetes per Cassandra e Redis si trovano nella
seguente struttura di directory all'interno della directory $APIGEECTL_HOME:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema รจ stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-08-18 UTC."],[[["\u003cp\u003eThis documentation explains how to use Kubernetes Network Policies to control traffic flow to Cassandra and Redis pods within an Apigee Hybrid cluster.\u003c/p\u003e\n"],["\u003cp\u003eKubernetes Network Policies allow the isolation of Cassandra pods, restricting communication to only the necessary pods like Runtime, Synchronizer, and Mart.\u003c/p\u003e\n"],["\u003cp\u003eEnabling network policies is a prerequisite and varies depending on the cluster platform, such as GKE, EKS, or AKS.\u003c/p\u003e\n"],["\u003cp\u003eThe configuration files for the Kubernetes network policies for Cassandra and Redis are located within the \u003ccode\u003e$APIGEECTL_HOME\u003c/code\u003e directory.\u003c/p\u003e\n"],["\u003cp\u003eApplying and validating the network policies involves labeling namespaces and using \u003ccode\u003ekubectl\u003c/code\u003e commands to apply and verify the configurations.\u003c/p\u003e\n"]]],[],null,["# Configuring Kubernetes network policies\n\n| You are currently viewing version 1.10 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to use Kubernetes network policies to secure Cassandra and Redis pods\nwithin an Apigee Hybrid Cluster .\n\nOverview\n--------\n\n\nWhen you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then\nyou can use Kubernetes Network Policies for applications in your cluster. Network Policies are an\napplication-centric construct you can use to specify how a pod is allowed to communicate with\nother pods in your cluster.\n\n\nIn Apigee hybrid you can use Kubernetes Network Policies to isolate Cassandra pods so that only\npods that are intended to communicate with Cassandra are allowed to, such as the Runtime,\nSynchronizer, and Mart pods. Other pods in the cluster like Ingres and Watcher pods that do not\nneed to communicate with Cassandra are blocked from doing so.\n\n\nIf you have no restrictions on which pods can interact within your cluster, you do not need to\nuse Kubernetes network policies.\n\nPrerequisites\n-------------\n\n- Enable network policies in your cluster.\n - **GKE** : See [Enabling\n network policy enforcement](/kubernetes-engine/docs/how-to/network-policy#enabling_network_policy_enforcement).\n - **EKS** : See [Installing\n the Calico network policy engine add-on](https://docs.aws.amazon.com/eks/latest/userguide/calico.html).\n - **AKS** : See [Secure\n traffic between pods using network policies in Azure Kubernetes Service (AKS)](https://docs.microsoft.com/en-us/azure/aks/use-network-policies).\n - Other platforms: look for instructions to enable network policies on your cluster from your specific platform vendor.\n- A currently running Apigee hybrid cluster, version 1.8 or newer.\n\nProcedure\n---------\n\nIf you are running hybrid version 1.8.x, download and extract the newest Apigee release\npackage.\n\n### Linux\n\n```\ncurl -LO \\\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.10.5/apigeectl_linux_64.tar.gz\n```\n\n### Mac OS\n\n```\ncurl -LO \\\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.10.5/apigeectl_mac_64.tar.gz\n```\n\n### Windows\n\n```\ncurl -LO ^\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.10.5/apigeectl_windows_64.zip\n```\n\n\nThe configuration files for the Kubernetes network policies for Cassandra and Redis are in the\nfollowing directory structure within your `$APIGEECTL_HOME` directory: \n\n```scdoc\n โโโ apigeectl\n โโโ examples\n โโโ network-policies\n โโโ securing-cassandra-redis-pods\n โโโ README.md\n โโโ base\n โ โโโ cluster-scoped-communication\n โ โโโ cassandra\n โ โ โโโ kustomization.yaml\n โ โ โโโ networkpolicy-cassandra-allow-controller.yaml\n โ โ โโโ networkpolicy-cassandra-allow-intranode.yaml\n โ โ โโโ networkpolicy-cassandra-allow-mart.yaml\n โ โ โโโ networkpolicy-cassandra-allow-runtime.yaml\n โ โ โโโ networkpolicy-cassandra-alow-sync.yaml\n โ โ โโโ networkpolicy-cassandra-create-user.yaml\n โ โ โโโ networkpolicy-cassandra-monitoring.yaml\n โ โ โโโ networkpolicy-cassandra-remove-dc.yaml\n โ โโโ redis\n โ โโโ kustomization.yaml\n โ โโโ networkpolicy-redis-envoy.yaml\n โ โโโ networkpolicy-redis.yaml\n โโโ overlays\n โโโ ORG_NAME\n โโโ kustomization.yaml\n```\n\nWhere \u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e is the name of your Apigee organization.\n\n1. Label the namespaces with the following command: \n\n kubectl label namespace apigee app=apigee\n kubectl label namespace apigee-system app=apigee-system\n\n2. Apply the network policies with the following command: \n\n ```\n kubectl apply -k ${APIGEECTL_HOME}/examples/network-policies/securing-cassandra-redis-pods/overlays/ORG_NAME\n ```\n3. Validate that the network policies were applied with the following command: \n\n ```\n kubectl get netpol -n apigee\n ```\n\n\n The following network policies should be created in the `apigee` namespace: \n\n ```text\n NAME POD-SELECTOR AGE\n cassandra-from-mart app=apigee-cassandra 4d5h\n cassandra-from-runtime app=apigee-cassandra 4d5h\n cassandra-from-sync app=apigee-cassandra 4d5h\n cassandra-to-cassandra app=apigee-cassandra 4d5h\n controller-to-cassandra app=apigee-cassandra 4d5h\n redis-from-redisenvoy app=apigee-redis 3d18h\n redisenvoy-from-runtime app=apigee-redis-envoy 3d18h\n \n ```"]]
