Isolating kubernetes namespaces using NSX-T distributed firewall (DFW) Rules

Products

• VMware NSX

Issue/Introduction

By default all pods in all namespace can communicate with each other. A set of DFW rules should be created in order to deny all the traffic from other namespaces while allowing all the traffic coming from the same namespace the pod is deployed to.

Environment

VMware PKS 1.x

Resolution

You can create DFW rules in such a way that only pods inside a namespace can reach each other, but intra-namespace connections should not be allowed. These rules can be created manually per the following guidelines:

• On top, you will create a rule with source and destination as the same namespace subnet and set to Allow.
• On the bottom, the source should be ANY, the destination should be namespace subnet and set to Deny.
• After the second rule, create a rule for Egress Traffic wherein the source should be namespace subnet, the destination should be ANY and set to Allow.