anchor.diff: -= Kubernetes - Enforcing Network Security Policies With Calico
  += Kubernetes - Enforcing Network Security Policies with Calico
   
   == Introduction
   
  -https://www.projectcalico.org[Calico] is an open-source plugin that allows for fine-grained network policy enforcement, ensuring that traffic within your Kubernetes cluster can only flow in the direction that you specify.  As an example, if we take a scenario where Kubernetes namespaces are used ot enforce boundaries between products, or even enforce boundaries between differnet environments (e.g. development vs production), network policies can be configured to ensure no unauthorized network traffic is allowed beyond its boundary.  Think of it as being similar to applying Security Groups in the AWS world.
  +https://www.projectcalico.org[Calico] is an open-source plugin that allows for fine-grained network policy enforcement, ensuring that traffic within your Kubernetes cluster can only flow in the direction that you specify.  As an example, if we take a scenario where Kubernetes namespaces are used opt enforce boundaries between products, or even enforce boundaries between different environments (e.g. development vs production), network policies can be configured to ensure no unauthorized network traffic is allowed beyond its boundary.  Think of it as being similar to applying Security Groups in the AWS world.
   
  -This excerise will walk you through configuring Calico and applying a Network Policy.
  +This exercise will walk you through configuring Calico and applying a Network Policy.
   
  -== Pre-requisities
  +== Pre-requisites
   
  -Although Calico can be installed on a variety of Kubernetes configurations, this exercise assumes that you have a running Kubernetes cluster deployed ot AWS via `kops`.
  +Although Calico can be installed on a variety of Kubernetes configurations, this exercise assumes that you have a running Kubernetes cluster deployed opt AWS via `kops`.
   
   == Installation
   
  
positive.code: 
  == Advanced Topics
  
  === Preventing Outboud access
  
  The Kubernetes Network Policies allow you to isolate inbound traffic only.  To filter outbound traffic you need to configure Calico directly using the `calicoctl` tool.  Refer to the section https://docs.projectcalico.org/v2.6/getting-started/kubernetes/tutorials/advanced-policy[Prevent outgoing connections from pods] for further information.
  
negative.code: ----
  
  
  == Exercise 1:  Enforcing Network Isolation
  
  This exercise introduces you to configuring Calico.  We will create a namespace, deploy some test pods into it, and see the before and after effects of configuring a Calico based Network Policy.
  
  