En este tema se explica cómo usar las políticas de red de Kubernetes para proteger los pods de Cassandra y Redis en un clúster de Apigee Hybrid .
Información general
Si quieres controlar el flujo de tráfico a nivel de dirección IP o de puerto (capa 3 u 4 de OSI), puedes usar las políticas de red de Kubernetes para las aplicaciones de tu clúster. Las políticas de red son un constructo centrado en las aplicaciones que puedes usar para especificar cómo se permite que un pod se comunique con otros pods de tu clúster.
En Apigee hybrid, puedes usar políticas de red de Kubernetes para aislar los pods de Cassandra de forma que solo se permita la comunicación con Cassandra a los pods que estén diseñados para ello, como los pods de Runtime, Synchronizer y Mart. Otros pods del clúster, como los pods de Ingres y Watcher, que no necesitan comunicarse con Cassandra, no pueden hacerlo.
Si no tienes restricciones sobre qué pods pueden interactuar en tu clúster, no necesitas usar políticas de red de Kubernetes.
Los archivos de configuración de las políticas de red de Kubernetes para Cassandra y Redis se encuentran en la siguiente estructura de directorios de tu directorio $APIGEECTL_HOME:
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-08-28 (UTC)."],[[["\u003cp\u003eThis document provides instructions on using Kubernetes Network Policies to secure Cassandra and Redis pods within an Apigee Hybrid cluster.\u003c/p\u003e\n"],["\u003cp\u003eKubernetes Network Policies allow you to control traffic flow at the IP address or port level (OSI layer 3 or 4) between pods.\u003c/p\u003e\n"],["\u003cp\u003eYou can isolate Cassandra pods to only allow communication with specific pods like Runtime, Synchronizer, and Mart.\u003c/p\u003e\n"],["\u003cp\u003eEnabling network policies in your specific Kubernetes cluster, such as GKE, EKS, or AKS, is a prerequisite for implementing these policies.\u003c/p\u003e\n"],["\u003cp\u003eTo apply the policies, you must label the \u003ccode\u003eapigee\u003c/code\u003e and \u003ccode\u003eapigee-system\u003c/code\u003e namespaces and use the \u003ccode\u003ekubectl apply\u003c/code\u003e command on a specified directory, after which you can validate the created network policies.\u003c/p\u003e\n"]]],[],null,["# Configuring Kubernetes network policies\n\n| You are currently viewing version 1.9 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to use Kubernetes network policies to secure Cassandra and Redis pods\nwithin an Apigee Hybrid Cluster .\n\nOverview\n--------\n\n\nWhen you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then\nyou can use Kubernetes Network Policies for applications in your cluster. Network Policies are an\napplication-centric construct you can use to specify how a pod is allowed to communicate with\nother pods in your cluster.\n\n\nIn Apigee hybrid you can use Kubernetes Network Policies to isolate Cassandra pods so that only\npods that are intended to communicate with Cassandra are allowed to, such as the Runtime,\nSynchronizer, and Mart pods. Other pods in the cluster like Ingres and Watcher pods that do not\nneed to communicate with Cassandra are blocked from doing so.\n\n\nIf you have no restrictions on which pods can interact within your cluster, you do not need to\nuse Kubernetes network policies.\n\nPrerequisites\n-------------\n\n- Enable network policies in your cluster.\n - **GKE** : See [Enabling\n network policy enforcement](https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy#enabling_network_policy_enforcement).\n - **EKS** : See [Installing\n the Calico network policy engine add-on](https://docs.aws.amazon.com/eks/latest/userguide/calico.html).\n - **AKS** : See [Secure\n traffic between pods using network policies in Azure Kubernetes Service (AKS)](https://docs.microsoft.com/en-us/azure/aks/use-network-policies).\n - Other platforms: look for instructions to enable network policies on your cluster from your specific platform vendor.\n- A currently running Apigee hybrid cluster, version 1.8 or newer.\n\nProcedure\n---------\n\nIf you are running hybrid version 1.8.x, download and extract the newest Apigee release\npackage.\n\n### Linux\n\n```\ncurl -LO \\\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.9.4/apigeectl_linux_64.tar.gz\n```\n\n### Mac OS\n\n```\ncurl -LO \\\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.9.4/apigeectl_mac_64.tar.gz\n```\n\n### Windows\n\n```\ncurl -LO ^\n https://storage.googleapis.com/apigee-release/hybrid/apigee-hybrid-setup/1.9.4/apigeectl_windows_64.zip\n```\n\n\nThe configuration files for the Kubernetes network policies for Cassandra and Redis are in the\nfollowing directory structure within your `$APIGEECTL_HOME` directory: \n\n```scdoc\n └── apigeectl\n └── examples\n └── network-policies\n └── securing-cassandra-redis-pods\n ├── README.md\n ├── base\n │ └── cluster-scoped-communication\n │ ├── cassandra\n │ │ ├── kustomization.yaml\n │ │ ├── networkpolicy-cassandra-allow-controller.yaml\n │ │ ├── networkpolicy-cassandra-allow-intranode.yaml\n │ │ ├── networkpolicy-cassandra-allow-mart.yaml\n │ │ ├── networkpolicy-cassandra-allow-runtime.yaml\n │ │ ├── networkpolicy-cassandra-alow-sync.yaml\n │ │ ├── networkpolicy-cassandra-create-user.yaml\n │ │ ├── networkpolicy-cassandra-monitoring.yaml\n │ │ └── networkpolicy-cassandra-remove-dc.yaml\n │ └── redis\n │ ├── kustomization.yaml\n │ ├── networkpolicy-redis-envoy.yaml\n │ └── networkpolicy-redis.yaml\n └── overlays\n └── ORG_NAME\n └── kustomization.yaml\n```\n\nWhere \u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e is the name of your Apigee organization.\n\n1. Label the namespaces with the following command: \n\n kubectl label namespace apigee app=apigee\n kubectl label namespace apigee-system app=apigee-system\n\n2. Apply the network policies with the following command: \n\n ```\n kubectl apply -k ${APIGEECTL_HOME}/examples/network-policies/securing-cassandra-redis-pods/overlays/ORG_NAME\n ```\n3. Validate that the network policies were applied with the following command: \n\n ```\n kubectl get netpol -n apigee\n ```\n\n\n The following network policies should be created in the `apigee` namespace: \n\n ```text\n NAME POD-SELECTOR AGE\n cassandra-from-mart app=apigee-cassandra 4d5h\n cassandra-from-runtime app=apigee-cassandra 4d5h\n cassandra-from-sync app=apigee-cassandra 4d5h\n cassandra-to-cassandra app=apigee-cassandra 4d5h\n controller-to-cassandra app=apigee-cassandra 4d5h\n redis-from-redisenvoy app=apigee-redis 3d18h\n redisenvoy-from-runtime app=apigee-redis-envoy 3d18h\n \n ```"]]
