Managing traffic within Kubernetes clusters can quickly become complex as applications grow. Kubernetes network policies provide a way to control traffic flow at the pod level, but they often aren't enough to address every scenario—especially when you need fine-grained control over external access. That's where combining access proxies with network policies comes in. This blog outlines the key concepts of access proxies and Kubernetes network policies and steps to use them together to create more secure and reliable traffic management.
What are Kubernetes Network Policies?
Kubernetes network policies are rules that determine which pods can communicate with each other, based on their labels. By default, pods in a Kubernetes cluster can freely communicate across namespaces. Network policies give administrators the tools to restrict incoming and outgoing connections for specific pods, enforcing a zero-trust model inside the cluster.
For instance, you can define a network policy to allow traffic only from pods in a "frontend"namespace to the pods in a "backend"namespace, while blocking all other traffic. These rules help limit your attack surface, ensuring that pods only communicate when necessary.
But network policies alone can only handle certain use cases like internal traffic among pods. The moment external traffic comes into play, additional tools are required.
What is an Access Proxy?
An access proxy acts as a gatekeeper for external traffic entering your Kubernetes cluster. Access proxies are typically configured to filter and route requests to the appropriate services by implementing authentication, authorization, and protocol-specific rules (e.g., HTTP, gRPC, etc.).
They extend the capabilities of network policies by acting on application-level details, not just IPs or port-level rules. This makes them an ideal solution for enforcing stricter security on ingress traffic, while still leveraging network policies for pod-to-pod communication.
For example, when a user attempts to access an API endpoint, the access proxy can validate their identity, verify their permissions, and only then pass the request along to the correct Kubernetes service.
Why Combine Access Proxies with Network Policies?
On their own, network policies address in-cluster communication effectively. However, the moment external traffic (e.g., from users or external systems) tries to access your cluster, network policies hit a wall. They’re simply not built to manage complex, application-aware decisions about external requests.