Traffic Security · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Inspect
kubectl get ingressclass | Installed controllers (and the default) |
kubectl get ingress -A | Hosts, addresses and TLS per Ingress |
kubectl describe ingress <name> | Rules, backends and events |
Test TLS
curl -vk --resolve shop.example.com:443:<LB-IP> https://shop.example.com/ | Test a host before DNS points to it |
openssl s_client -connect <LB-IP>:443 -servername shop.example.com </dev/null | openssl x509 -noout -subject -dates | Which certificate is served for this name (SNI) |
Objects
GatewayClass | Which implementation (like IngressClass): owned by the infrastructure provider |
Gateway | Listeners (ports, protocols, hostnames, TLS): owned by the platform team |
HTTPRoute | Routing rules for an app: owned by the app team |
ReferenceGrant | Allows a reference into another namespace (e.g. a Route to a Service) |
Inspect
kubectl get gatewayclass,gateway -A | Implementations and gateways (with addresses) |
kubectl get httproute -A | Routes and their parent gateways |
kubectl describe httproute <name> | status.parents: Accepted / ResolvedRefs conditions |
Policy building blocks
podSelector: {} | All pods in the namespace |
policyTypes: ["Ingress", "Egress"] | Which directions this policy restricts |
namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: shop}} | Pods in a specific namespace (label set automatically) |
ipBlock: {cidr: 10.0.0.0/8} | Traffic to/from IP ranges (outside the cluster) |
Test
kubectl -n shop exec deploy/web -- wget -qO- -T 3 http://api:8080 | Allowed? (timeout = blocked) |
kubectl get networkpolicy -A | Which namespaces are isolated |
