Managing Kubernetes network policies can be risky if you can’t see the impact before you deploy them. In this video, Dean Lewis walks you through Isopolicy’s Simulate and Tune features and show how you can preview, refine, and validate Cilium network policies without breaking live workloads. Introduction I'm going to show you a new tool which makes managing silly network policies a hell of a lot easier it's something that's been asked for by our customers. It's been asked by ourselves internally here at Iceveillent and we're ready to share this with you as part of iceent networking for Kubernetes 1.18 release going forward you can get this from our documentation pages or if you're early to that you can get in touch with our support team and they'll help you get enabled with this as well but what is it exactly that I'm going to be showing you? So let's have a quick look and how about a policy tool which goes off looks at all of the flows inside of your environment and the active network policies and then starts to provide you tuning recommendations for you to. Isopolicy overview improve your security posture. So I'm already going to jump through a quick forward preview of what we're going to show in this demo today but just look at this right now very quickly I ran that command as I'm speaking and we can see in my default namespace I've got one policy enabled at the moment which allows us DNS visibility it actually allows me to make the request from my workload running inside of that namespace to the cube DNS services and at the moment inside of my policy we can see that we do not have a protocol set so we can communicate on protocol UDP or TCP however, all of the available flows tell me if I look through them manually that we're only using UDP traffic and also as well I have no endpoint selector available inside of that policy it's quite a wide scope if there's any new workloads created maybe not by myself maybe nefariously by bad actor for example this existing policy would also apply to them as well which maybe is not something I want if I'm thinking about implementing a zero trust model inside of my environment. So again here this tool straight away is telling me hey Dean why don't we set these additional labels inside the endpoint selector so that we can ensure that we're only targeting the workloads that are running inside of our namespace at the moment and that nothing else is going to be accidentally picked up and that's really powerful that's that's fantastic we could add this into. Isopolicy setup a GitOps type situation. so if you've got githops type methodology and tooling in place inside of your department, we could add this to reduce the burden on your network security teams to validate and check everything inside of the environment we can also use this to harden our platforms going forward. So let's start by going through my environment and then we're going to show you the ISO policy tool now in more detail so you can see all of its features. features. So inside of my environment I have one just one single pod running today. H we're actually using the live examples from one of our latest blog post which is how to safely manage Cilium network policies inside your environment and use simulation tools like this ISO policy tooling I'm taking you through today. I'm going to drop the link down in a corner for you with a little bit of QR code as well so you can go straight to that blog post. some really fantastic tips there for you to help get to grips with using slim network policies. So inside of my environment I have my running pod. I've also if I spell ubectl right I've got one network policy at the moment. So if I just go oh yl and we can see all that network policy does is captures all traffic from any endpoint inside of where it's deployed. So, it's deployed inside of the default namespace and it's looking for traffic to match going to the internal cube DNS inside of my system at the moment and pattern match any type of DNS request this also means that my workload at the moment has no ability to talk to the outside world because it's going to be denied by default. All the traffic is allowed is that DNS request traffic itself. traffic itself. So, at the moment, if I try to go to cisco.com, and I'm just going to add a quick time out on the end there as well just to make this a little bit faster for today's demo we're going to see. Policy configuration that fails, and that's to be expected. expected. So, what we're going to do is I'm going to now use the ISO policy tooling we're going to have quick look at those options and arguments that are available. So we can see here the ISO policy tooling provides silly network policy suggestions and simulations inside of your environment we've got a couple of different options there. So we can lint so we can report on issues for any deployed sel network policy inside of your cluster today we can observe we can create a snapshot to dis so we can use this tool link elsewhere if needed or maybe we save this part of our githops environment as well as part of those runs and checks so it can be looked back in the future, we're going to be looking at the simulate and the tune option today. So, simulate is exactly as it sounds we're going to take a policy that we've created and simulate it against our running environment before we apply it to see if it has the affected outcome that we want to make sure we're not making mistakes with our policy or blocking traffic that shouldn't be blocked and the tune is what I've just shown right at the start as well, which is looking holistically at your whole cluster or just individual name spaces to see if there's a way to lock down those policies further. So, let's start by adding a new Cilium network policy into my environment. So I'm going to do kubectl apply and I'm just going to pipe in my YAML file and what we're doing here very simply is we're selecting my single pod that's running using the label that's available and we're saying any traffic to the FQDN is icevalent.com is allowed. So now I've got this policy available if I try and go to cisco.com again, we're going to get a termination message there if we go to the example.com, we get a termination as well. ignore this websocket message. That's just my demo environment catching up in the background, but nothing to worry about for today's demo. I'm just going to clear that down to keep everything a bit more concise on my terminal window. Okay, so I'm now going to go to ice.com. I'm going to see that works because it's allowed by the policy. We have a updated version of that policy saved in a folder as well. So if I just do a quick cat to my proposed folder and then we've got the ISO policy CMP example update YAML file it's the exact same YAML file that we showed before with one change only which is changing the name to cisco.com we're going to see here that the ISO policy CMP example is the same name. So we're not adding a new policy we're going to update that policy inside of our environment. So what we want to do is we want to simulate what happens in. Deploy Isopolicy my environment when I now apply that policy. So we're going to run ISO policy simulate we're just going to look at the default namespace where my workloads are deployed and we're just going to say read all the files in that proposed directory. there is only that single YAML file in that proposed directory today as we can see that was really quick. So it's pulling from the live environment as it stands today. So let's talk through a little bit of this. So we can see we've loaded the simulation that single file that I showed you it's the it shows the name of the namespace and the CMP name applied we can see the deployed network policies that are currently taking effect today. Okay. So, we can see we've got our traffic being affected by the policy that's in place we can also see the DNS traffic being affected by the DNS visibility policy and we can see that our traffic is allowed today and the type of traffic and so forth if we then go down, we can then see what the simulated network policies are in place. So, we are thinking about the default ISO policy. So, it's the same name because we're updating that policy. We're looking at that traffic which is cisco.com that's what we're simulating and we can see already that the policy is going to be allow and if I go down to the simulation results, we're going to see the same as well the simulation results show this in a slightly different format and the reason why that's important is because here very quickly, I can see what's going to happen with my expected traffic. So I can see here with the little plus symbol that the traffic to cisco.com would now be allowed by that policy update. However, my existing flows also show that the traffic that has already happened has already been transmitted out of my environment that would be affected as well and potentially denied by my policy. So, this little minus symbol here is showing that this flow would no longer be allowed by the policy because we've removed iceent.com from that to FQDN list which is going to have a negative effect if I was expecting to still access Isovalent.com. So that's fantastic because I can see all of this happening without having to apply to my cluster, go through Hubble observe and then look at the policy verdicts for example. so yeah really simple really great tooling from that point of view to kind of get to grips with. shall we take a look at that tune command again as well before we wrap up this video off so I'm going to go to ISO policy tune. I'm going to. Conclusion do include ns and I'm just going to look at my default namespace again because otherwise without this command it would look at my whole cluster and I'm going to add a range command to this. I'm going to put 50 minutes in place and what's happening here is it's going to now automatically discover and connect to timecape deployed into my cluster to pull the historical flows from timecape to consider as well as path tuning. So now we can see we're ingesting flows if we go down we can see at the moment we've just got one policy which is being considered for tuning out of the two that have been applied inside of my environment already and again as I mentioned at the very start of this demo it's the same recommendations. So it's about how to handle locking down the protocols inside of that policy for the other flows that have been observed inside of my environment and also updating that endpoint selector. So again, it only applies to those workloads inside of my environment. So yeah, we're going to bring this video to a close. really quick wrap up of showing you the power of the ISO policy tooling which allows you to validate, simulate and optimize the sum network policies inside your environment either manually as I've done today simulating it as kind of a network operator just kind of checking things in my environment or again programmatically you can build this into your githops pipelines going forward. Have a good day.