Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Calico and stars policy

107 views

Published on

Calico and stars policy

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Calico and stars policy

  1. 1. Anirban Sen Chowdhary
  2. 2. “Project Calico is the world's simplest, most scalable, open networking solution for OpenStack”.  Calico, a pure layer3 approach to Virtual Networking for highly scalable &  flexible Data centers. It is a open-source technology, that  implements   large, standards-based cloud data center infrastructures  Calico supports rich and flexible network policy that enforces on every  node in a cluster, to provide tenant isolation, security groups, and external  reachability constraints.
  3. 3. Calico has following features: .
  4. 4. Calico has following features: .
  5. 5. Calico has following features: .
  6. 6. Calico has following features: .
  7. 7. Calico has following features: .
  8. 8. There is security layer into Calico that enables developers and operations staff to easily define with fine granularity which connections are allowed, and which are not. These rules implement and extend the Kubernetes Network Policy API.
  9. 9. There are basically 3 policy demo we can configure: * Simple Policy Demo * Stars Policy Demo * Advanced Policy Demo
  10. 10. We will discuss on the overview of Star Policy Demo.
  11. 11. It includes demo that sets up a frontend and backend service, as well as a client service for all running on Kubernetes. It then configures network policy on each service..
  12. 12. We need to install Kubernetes in the system which includes Network Policy API. We need to get the following thing: Calico and then need to get into star-policy directory of Calico
  13. 13. 1) Create the frontend, backend, client, and management-ui apps: The management UI runs as a NodePort Service on Kubernetes, and shows the connectivity of the Services. Once all the pods are started, they should have full connectivity.
  14. 14. 2) Enable isolation: Following commands will prevent all access to the frontend, backend, and client Services. Let’s now refresh the management UI which may take up to 10 seconds for changes to be reflected in the UI and now since we’ve enabled isolation, the UI can no longer able to access the pods, and because of that reason all they might no longer be shown up in the UI.
  15. 15. 3) Allow the UI to access the Services using NetworkPolicy objects: If we now refresh after some time, the UI - it should now show the Services, but also in this case, they should not be able to access each other any more.. We will access allow-ui.yaml and allow-ui-client.yaml
  16. 16. 4) Creation of the “backend-policy.yaml” file to allow traffic from the frontend to the backend: Some points now we can see now as follows: * The frontend can now access the backend. * The backend cannot access the frontend at all. * The client cannot access the frontend, nor can it access the backend.
  17. 17. 5) Exposing of the frontend service to the client namespace. : As now the client can now access the frontend, but not the backend. Neither the frontend nor the backend can initiate connections to the client. The frontend can still access the backend. As we can see at the end, we need to access frontend-policy.yaml to create the policy for accessing the frontend
  18. 18. In next slides, we will discuss the overview on other policy demo. Lets share our knowledge and effort on community so that the Calico community grows.
  19. 19. For more information visit https://www.projectcalico.org/ https://docs.projectcalico.org/v2.6/introduction/ https://blog.tigera.io/tagged/calico

×