Anirban Sen Chowdhary

“Project Calico is the world's simplest, most scalable, open networking solution for OpenStack”. 

Calico, a pure layer3 approach to Virtual Networking for highly scalable & flexible Data centers. It is a open-source technology, that  implements  large, standards-based cloud data center infrastructures 

Calico supports rich and flexible network policy that enforces on every node in a cluster, to provide tenant isolation, security groups, and external reachability constraints.

Calico has following features:.

Calico has following features:.

Calico has following features:.

Calico has following features:.

Calico has following features:.

There is security layer into Calico that enables developers and operations staff to easily define with fine granularity which connections are allowed, and which are not. These rules implement and extend the Kubernetes Network Policy API.

There are basically 3 policy demo we can configure:* Simple Policy Demo * Stars Policy Demo * Advanced Policy Demo

We will discuss on the overview of Star Policy Demo.

It includes demo that sets up a frontend and backend service, as well as a client service for all running on Kubernetes.It then configures network policy on each service..

We need to install Kubernetes in the system which includes Network Policy API.We need to get the following thing:Calico

and then need to get into star-policy directory of Calico

1) Create the frontend, backend, client, and management-ui apps:

The management UI runs as a NodePort Service on Kubernetes, and shows the connectivity of the Services.Once all the pods are started, they should have full connectivity.

2) Enable isolation:

Following commands will prevent all access to the frontend, backend, and client Services.

Let’s now refresh the management UI which may take up to 10 seconds for changes to be reflected in the UI and now since we’ve enabled isolation, the UI can no longer able to access the pods, and because of that reason all they might no longer be shown up in the UI.

3) Allow the UI to access the Services using NetworkPolicy objects:

If we now refresh after some time, the UI - it should now show the Services, but also in this case, they should not be able to access each other any more..

We will access allow-ui.yaml and allow-ui-client.yaml

4) Creation of the “backend-policy.yaml” file to allow traffic from the frontend to the backend:

Some points now we can see now as follows:

* The frontend can now access the backend.* The backend cannot access the frontend at all.* The client cannot access the frontend, nor can it access the backend.

5) Exposing of the frontend service to the client namespace. :

As now the client can now access the frontend, but not the backend. Neither the frontend nor the backend can initiate connections to the client. The frontend can still access the backend.

As we can see at the end, we need to access frontend-policy.yaml to create the policy for accessing the frontend

In next slides, we will discuss the overview on other policy demo.

Lets share our knowledge and effort on community so that the Calico community grows.

For more information visit

https://www.projectcalico.org/

https://docs.projectcalico.org/v2.6/introduction/

https://blog.tigera.io/tagged/calico