Architecture Overview

Mon, 01 Jan 0001 00:00:00 +0000

The kube-network-policies project is designed to enforce Kubernetes network policies by intercepting and evaluating network packets in userspace. This is achieved by using NFQUEUE to redirect packets to the controller, which then decides whether to allow or deny them based on a pipeline of policy evaluators.

Packet Flow

The following diagram illustrates the flow of a network packet from the Linux kernel to the userspace controller and back:

graph TD
 Packet[Incoming/Outgoing Packet] --> Kernel[Linux Kernel]
 Kernel -->|nftables rule matches| NFQ[NFQUEUE]
 NFQ -->|Intercepted| Controller[Dataplane Controller]
 Controller -->|Evaluate packet| Engine[Policy Engine]
 Engine -->|Query Pod Info| PIP[Pod Info Provider]
 Engine -->|Process through| Pipeline[Policy Evaluators Pipeline]
 Pipeline -->|Verdict: Accept/Deny| Engine
 Engine -->|Send Verdict| Controller
 Controller -->|Set NFQ verdict| Kernel
 Kernel -->|Allow/Drop packet| Done[Done]

To avoid the performance penalty of sending all packets to userspace, the controller includes logic to only capture packets for pods that are targeted by at least one network policy.

Policy Evaluators

Mon, 01 Jan 0001 00:00:00 +0000

The PolicyEvaluator interface is the core abstraction of the packet filtering pipeline in kube-network-policies. Each evaluator is responsible for processing a packet and deciding its outcome based on its policy implementation.

The PolicyEvaluator Interface

The interface is defined in pkg/api/interfaces.go (or pkg/networkpolicy/engine.go) as follows:

type PolicyEvaluator interface { 
 Name() string 
 EvaluateIngress(ctx context.Context, p *network.Packet, srcPod, dstPod *api.PodInfo) (Verdict, error) 
 EvaluateEgress(ctx context.Context, p *network.Packet, srcPod, dstPod *api.PodInfo) (Verdict, error) 
}

The Verdict returned by each evaluator can be one of the following:

VerdictAccept: The packet is allowed, and no further evaluators in the pipeline are consulted.
VerdictDeny: The packet is denied, and no further evaluators are consulted.
VerdictNext: The packet does not match this policy (or is passed through), and the engine continues to the next evaluator in the pipeline.

The Pipeline Order

When a packet is evaluated, it is processed sequentially by a pipeline of policy evaluators. The order is crucial, especially for Admin Network Policies:

Concepts on Kubernetes Network Policies

Architecture Overview

Packet Flow

Policy Evaluators

The PolicyEvaluator Interface

The Pipeline Order