Why Ingress and egress rules in Kubernetes? - Purpose & Use Cases

The Big Idea

What if a simple set of rules could stop network chaos and protect your apps effortlessly?

The Scenario

Imagine you run a busy office where everyone needs to enter and leave through the same door without any guidance or rules.

Visitors, employees, and deliveries all crowd the entrance, causing confusion and delays.

The Problem

Without clear rules, people block each other, some enter where they shouldn't, and important deliveries get lost.

Manually telling everyone where to go every time wastes time and causes mistakes.

The Solution

Ingress and egress rules act like smart traffic lights and signs for your network.

They control who can come in (ingress) and who can go out (egress), making sure only the right traffic flows at the right time.

Before vs After

✗ Before

Allow all traffic without restrictions

✓ After

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-specific-ingress
spec:
  podSelector:
    matchLabels:
      role: backend
  ingress:
  - from:
    - ipBlock:
        cidr: 192.168.1.0/24
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24

What It Enables

With ingress and egress rules, you can safely control network traffic, protect your apps, and keep your system running smoothly.

Real Life Example

Think of a company that only allows customer support staff to access the database servers, while blocking all other departments from that sensitive area.

Key Takeaways

Manual network control is confusing and error-prone.

Ingress and egress rules automate and secure traffic flow.

This keeps your Kubernetes apps safe and efficient.

Practice

1. What do Ingress rules control in Kubernetes NetworkPolicies?

easy

A. CPU resource limits for pods

B. Incoming traffic to pods

C. Storage access for pods

D. Outgoing traffic from pods

Solution

1. Step 1: Understand the role of Ingress rules

   Ingress rules specify which incoming network traffic is allowed to reach the pods.

2. Step 2: Differentiate from Egress rules

   Egress rules control outgoing traffic, not incoming.

3. Final Answer:

   Incoming traffic to pods -> Option B

4. Quick Check:

   Ingress = Incoming traffic [OK]

Hint: Ingress means incoming traffic control [OK]

Common Mistakes:

• Confusing ingress with egress
• Thinking ingress controls resource limits
• Mixing network traffic with storage access

2. Which of the following is the correct syntax to allow all incoming traffic from pods in namespace frontend using a NetworkPolicy ingress rule?

easy

A. ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend

B. egress:
- to:
- namespaceSelector:
matchLabels:
name: frontend

C. ingress:
- to:
- namespaceSelector:
matchLabels:
name: frontend

D. egress:
- from:
- namespaceSelector:
matchLabels:
name: frontend

Solution

1. Step 1: Identify ingress rule syntax

   Ingress rules use ingress: with from: to specify allowed sources.

2. Step 2: Confirm namespaceSelector usage

   Using namespaceSelector with matchLabels is correct to select pods in a namespace.

3. Final Answer:

   ingress: - from: - namespaceSelector: matchLabels: name: frontend -> Option A

4. Quick Check:

   Ingress uses 'from' to allow incoming traffic [OK]

Hint: 'ingress' with 'from' allows incoming traffic sources [OK]

Common Mistakes:

• Using 'to' instead of 'from' in ingress
• Confusing ingress with egress syntax
• Misplacing namespaceSelector under egress

3. Given this NetworkPolicy snippet, what traffic is allowed?

egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
        except:
        - 10.0.0.5/32

medium

A. All outgoing traffic to 10.0.0.0/24 except 10.0.0.5

B. All incoming traffic from 10.0.0.0/24 except 10.0.0.5

C. All outgoing traffic to 10.0.0.5 only

D. All incoming traffic from 10.0.0.5 only

Solution

1. Step 1: Analyze egress rule with ipBlock

   The rule allows outgoing traffic to IPs in 10.0.0.0/24 except 10.0.0.5.

2. Step 2: Confirm direction and exceptions

   Egress means outgoing traffic; 'except' excludes 10.0.0.5 from allowed IPs.

3. Final Answer:

   All outgoing traffic to 10.0.0.0/24 except 10.0.0.5 -> Option A

4. Quick Check:

   Egress with ipBlock except excludes IPs [OK]

Hint: Egress 'to' with ipBlock allows excepted IPs blocked [OK]

Common Mistakes:

• Confusing ingress with egress direction
• Misreading 'except' as allowed IP
• Mixing incoming and outgoing traffic

4. You wrote this NetworkPolicy egress rule but pods still cannot reach external IPs:

egress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

What is the error?

medium

A. NetworkPolicy must not have egress rules

B. CIDR 0.0.0.0/0 is invalid

C. Missing 'ports' section

D. Egress rules use 'to', not 'from'

Solution

1. Step 1: Check egress rule syntax

   Egress rules specify destinations with 'to', not 'from'. Using 'from' is invalid here.

2. Step 2: Understand correct usage

   Correct egress syntax uses 'to' to define allowed outgoing IP blocks.

3. Final Answer:

   Egress rules use 'to', not 'from' -> Option D

4. Quick Check:

   Egress uses 'to' for destinations [OK]

Hint: Egress rules always use 'to' keyword [OK]

Common Mistakes:

• Using 'from' in egress rules
• Assuming CIDR 0.0.0.0/0 is invalid
• Thinking ports are always required

5. You want to restrict pods to only receive traffic from pods in the same namespace and send traffic only to a specific external IP range 192.168.1.0/24. Which NetworkPolicy configuration achieves this?

hard

A. ingress:
- from:
- podSelector: {}
egress:
- from:
- ipBlock:
cidr: 192.168.1.0/24

B. ingress:
- from:
- namespaceSelector: {}
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24

C. ingress:
- from:
- podSelector: {}
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24

D. ingress:
- to:
- podSelector: {}
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24

Solution

1. Step 1: Configure ingress to allow same-namespace pods

   Using podSelector: {} allows traffic from all pods in the same namespace.

2. Step 2: Configure egress to allow only specific external IP range

   Egress uses to with ipBlock for 192.168.1.0/24 to restrict outgoing traffic.

3. Final Answer:

   ingress: - from: - podSelector: {} egress: - to: - ipBlock: cidr: 192.168.1.0/24 -> Option C

4. Quick Check:

   Ingress 'from' podSelector + Egress 'to' ipBlock [OK]

Hint: Ingress uses 'from' podSelector; egress uses 'to' ipBlock [OK]

Common Mistakes:

• Using 'from' in egress rules
• Using namespaceSelector instead of podSelector for ingress
• Mixing 'to' and 'from' keywords incorrectly