Advanced policy — L7, FQDN, and DNS-based controls

Advanced NetworkPolicy goes beyond L3/L4 to L7 (HTTP, gRPC, Kafka), FQDN, and DNS-based controls. This lesson walks each, the implementations, and the discipline.

L3/L4 vs L7 policies

flowchart LR
    A["NetworkPolicy L3/L4"] --> B["Source/destination IP"]
    A --> C["Port, protocol"]
    A --> D["Pod selector, namespace selector"]
    E[Cilium L7] --> F["HTTP path, method"]
    E --> G["gRPC service, method"]
    E --> H[Kafka topic]

The difference:

• L3/L4 NetworkPolicy. Standard Kubernetes NetworkPolicy: IP, port, protocol, Pod selector.
• L7 policies. Cilium with Envoy: HTTP path, method, gRPC service, Kafka topic.

L7 policies require a proxy (Envoy) that parses the application-layer traffic. Without a proxy, the policy can only see IP/port.

L7 HTTP policy (Cilium)

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: api-l7-policy
  namespace: prod-app
spec:
  endpointSelector:
    matchLabels:
      app: api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
                path: "/api/v1/.*"
              - method: "POST"
                path: "/api/v1/orders"

The L7 rule allows:

• GET to any /api/v1/* path.
• POST to /api/v1/orders.

Other methods or paths are denied.

L7 gRPC policy

ingress:
  - fromEndpoints:
      - matchLabels:
          app: client
    toPorts:
      - ports:
          - port: "50051"
            protocol: TCP
        rules:
          grpc:
            - method: "Charge"
              service: "payments.PaymentService"

The gRPC rule allows calls to the Charge method of the PaymentService. Other methods are denied.

FQDN-based egress

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: external-api
  namespace: prod-app
spec:
  endpointSelector:
    matchLabels:
      app: myapp
  egress:
    - toFQDNs:
        - matchName: "api.example.com"
        - matchName: "auth.example.com"
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP

The FQDN rule allows egress only to api.example.com and auth.example.com. Other external domains are denied.

Cilium resolves the FQDNs via DNS and updates the allowed destination IPs. The policy follows the DNS resolution.

DNS-based controls

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: dns-only-egress
  namespace: prod-app
spec:
  endpointSelector:
    matchLabels:
      app: myapp
  egress:
    - toEntities:
        - kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP

The DNS-only rule allows egress only to kube-dns (port 53). All other egress is denied.

Combined with FQDN policies, you can allow DNS resolution to kube-dns and FQDN-based egress to specific external domains.

The operational trade-offs

flowchart LR
    A[L7 policies] --> B[+ Fine-grained control]
    A --> C["- Requires proxy (Envoy)"]
    A --> D[- Performance overhead]
    A --> E[- Complex to maintain]

The trade-offs:

• Pros. Fine-grained control; allow by path, method, service.
• Cons. Requires Envoy; performance overhead; complex to maintain.

L7 policies are powerful but expensive. The discipline is to use them where they add value (security-critical APIs) and avoid them where L3/L4 is sufficient.

Quiz

The operational discipline

Advanced policy in production rests on five non-negotiable elements:

• Use L3/L4 where sufficient. Don’t reach for L7 unnecessarily.
• L7 for security-critical APIs. Path/method rules on payment APIs.
• FQDN for external services. DNS-aware selectors for services with multiple A records.
• DNS-only as a base policy. Allow DNS, then specific destinations.
• Test policy changes. Verify legitimate traffic is not blocked.

Advanced policy is powerful. The discipline is to use it deliberately, test it carefully, and avoid over-engineering.