[[["์ดํดํ๊ธฐ ์ฌ์","easyToUnderstand","thumb-up"],["๋ฌธ์ ๊ฐ ํด๊ฒฐ๋จ","solvedMyProblem","thumb-up"],["๊ธฐํ","otherUp","thumb-up"]],[["์ดํดํ๊ธฐ ์ด๋ ค์","hardToUnderstand","thumb-down"],["์๋ชป๋ ์ ๋ณด ๋๋ ์ํ ์ฝ๋","incorrectInformationOrSampleCode","thumb-down"],["ํ์ํ ์ ๋ณด/์ํ์ด ์์","missingTheInformationSamplesINeed","thumb-down"],["๋ฒ์ญ ๋ฌธ์ ","translationIssue","thumb-down"],["๊ธฐํ","otherDown","thumb-down"]],["์ต์ข ์ ๋ฐ์ดํธ: 2025-08-06(UTC)"],[],[],null,["# Configure a network policy\n\nThis page demonstrates how to use cluster network policies to control whether a\nPod can receive incoming (or Ingress) network traffic, and whether it can send\noutgoing (or Egress) traffic.\n\nNetwork policies allow you to limit connections between Pod objects, so you can\nreduce exposure to attack.\n\nNetwork policies act as a firewall on layer 3 or layer 4 of the\n[OSI model](http://wikipedia.org/wiki/OSI_model). They do not offer additional features\nsuch as authorization or encryption.\n\nRestricting incoming traffic to Pod objects\n-------------------------------------------\n\nA [`NetworkPolicy` object](https://kubernetes.io/docs/concepts/services-networking/network-policies/)\nlets you configure network access policies for a Pod. `NetworkPolicy` objects\ncontain the following information:\n\n- Pod objects the policy applies to. You define Pod objects and workloads with\n [labels and selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/).\n\n- Type of traffic the network policy affects: Ingress for incoming traffic,\n Egress for outgoing traffic, or both.\n\n- For Ingress policies, which Pod objects can connect to the specified Pod\n objects.\n\n- For Egress policies, the Pod objects to which the specified Pod objects can\n connect.\n\n### Example incoming traffic restriction\n\nThis section demonstrates the creation of an incoming traffic restriction on\na sample application. Modify this example to suit your own application\nenvironment.\n\n1. Run a web server application with the label `app=hello` and expose it\n internally in the cluster:\n\n kubectl run hello-web --labels app=hello \\\n --image=us-docker.pkg.dev/google-samples/containers/gke/hello-app:1.0 \\\n --port 8080 --expose\n\n2. Configure a `NetworkPolicy` to allow traffic to the `hello-web` Pod\n from only the `app=foo` Pod objects. GKE on AWS blocks incoming traffic\n from Pod objects that do not have this label, as well as external traffic, and\n traffic from Pod objects in a different Namespace.\n\n The following manifest selects Pod objects with the label `app=hello` and\n specifies an Ingress policy to allow traffic only from Pod objects with the\n label `app=foo`: \n\n kind: NetworkPolicy\n apiVersion: networking.k8s.io/v1\n metadata:\n name: hello-allow-from-foo\n spec:\n policyTypes:\n - Ingress\n podSelector:\n matchLabels:\n app: hello\n ingress:\n - from:\n - podSelector:\n matchLabels:\n app: foo\n\n3. Apply this policy to the cluster:\n\n kubectl apply -f hello-allow-from-foo.yaml\n\n### Verify the Ingress policy\n\n1. Run a temporary Pod with the label `app=foo`. To verify that incoming\n traffic is allowed, make a request to the `hello-web:8080` endpoint:\n\n kubectl run -l app=foo --image=alpine --restart=Never --rm -i -t foo-app \\\n -- wget -qO- --timeout=2 http://hello-web:8080\n\n If traffic from Pod `app=foo` to the `app=hello` Pod objects is enabled, the\n output looks like the following: \n\n Hello, world!\n Version: 1.0.0\n Hostname: hello-web-2258067535-vbx6z\n\n2. Run a temporary Pod with a different label (`app=other`) and make the same\n request to observe that the traffic is not allowed:\n\n kubectl run -l app=other --image=alpine --restart=Never --rm -i -t other-app \\\n -- wget -qO- --timeout=2 http://hello-web:8080\n\n The output confirms the connection doesn't receive a response: \n\n wget: download timed out\n\nRestrict outgoing traffic from Pod objects\n------------------------------------------\n\nYou can restrict outgoing traffic just as you would incoming traffic.\n\nHowever, to query internal hostnames such as `hello-web` or external hostnames\nsuch as `www.example.com`, you must create an Egress policy that allows\nDNS traffic on port 53 using TCP and UDP protocols.\n\nTo enable Egress network policies, deploy a `NetworkPolicy` controlling outbound\ntraffic from Pod objects with the label `app=foo` while allowing traffic only to\nPod objects with the label `app=hello`, as well as the DNS traffic.\n\nThe following manifest specifies a `NetworkPolicy` controlling Egress traffic\nfrom Pod objects with label `app=foo` with two allowed destinations:\n\n1. Pod objects in the same Namespace with the label `app=hello`\n2. Internal or external endpoints on port 53 (UDP and TCP)\n\n kind: NetworkPolicy\n apiVersion: networking.k8s.io/v1\n metadata:\n name: foo-allow-to-hello\n spec:\n policyTypes:\n - Egress\n podSelector:\n matchLabels:\n app: foo\n egress:\n - to:\n - podSelector:\n matchLabels:\n app: hello\n - ports:\n - port: 53\n protocol: TCP\n - port: 53\n protocol: UDP\n\nApply this policy to the cluster: \n\n kubectl apply -f foo-allow-to-hello.yaml\n\n### Validate the Egress policy\n\n1. Deploy a new web application called `hello-web-2` and expose it\n internally in the cluster:\n\n kubectl run hello-web-2 --labels app=hello-2 \\\n --image=us-docker.pkg.dev/google-samples/containers/gke/hello-app:1.0 --port 8080 --expose\n\n2. Run a temporary Pod with the label `app=foo` and validate that the Pod can\n establish connections to `hello-web:8080`:\n\n kubectl run -l app=foo --image=alpine --rm -i -t --restart=Never foo-app \\\n -- wget -qO- --timeout=2 http://hello-web:8080\n\n The Pod responds to the request: \n\n Hello, world!\n Version: 1.0.0\n Hostname: hello-web-2258067535-vbx6z\n\n3. Validate that the Pod can't establish connections to `hello-web-2:8080`:\n\n kubectl run -l app=foo --image=alpine --rm -i -t --restart=Never foo-app \\\n -- wget -qO- --timeout=2 http://hello-web-2:8080\n\n The output confirms the connection doesn't receive a response: \n\n wget: download timed out\n\n4. Validate that the Pod can't establish connections to external websites such\n as `www.example.com`.\n\n kubectl run -l app=foo --image=alpine --rm -i -t --restart=Never foo-app \\\n -- wget -qO- --timeout=2 http://www.example.com\n\n The output confirms the connection doesn't receive a response: \n\n wget: download timed out\n\nClean up\n--------\n\nTo remove the resources you created in this tutorial, run these commands: \n\n kubectl delete pods --labels app=hello-2\n kubectl delete pods --labels app=hello\n kubectl delete -f foo-allow-to-hello.yaml\n kubectl delete -f hello-allow-from-foo.yaml\n\nWhat's next\n-----------\n\n- [Kubernetes Network Policies documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/)\n- Use [network policy logging](/kubernetes-engine/multi-cloud/docs/aws/how-to/network-policy-logging) to record when connections to Pod objects are allowed or denied by your cluster's [network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)."]]
