{"id":441,"date":"2020-01-03T04:25:26","date_gmt":"2020-01-03T03:25:26","guid":{"rendered":"https:\/\/aymen-segni.com\/?p=441"},"modified":"2020-01-03T04:41:12","modified_gmt":"2020-01-03T03:41:12","slug":"secure-aks-at-the-deployment-part-3","status":"publish","type":"post","link":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/","title":{"rendered":"Secure AKS at the deployment &#8211; part 3 &#8211;"},"content":{"rendered":"\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>Welcome to the Azure AKS Kubernetes deployment security Workshop.<br>We won&#8217;t spend too much time on the presentation of AKS, the service that has been very popular in recent months.<br>In brief, AKS is Microsoft\u2019s new managed container orchestration service. It is gradually replacing Azure Container service and focuses only on the Cloud Native Computing foundation (CNCF) Kubernetes orchestration engine.<br> In the last workshop: <span style=\"text-decoration: underline;\"><a rel=\"noreferrer noopener\" aria-label=\"Create a Kubernetes cluster with Azure AKS using Terraform (opens in a new tab)\" href=\"https:\/\/aymen-segni.com\/index.php\/2019\/12\/24\/create-a-kubernetes-cluster-with-azure-aks-using-terraform\/\" target=\"_blank\">Create a Kubernetes cluster with Azure AKS using Terraform<\/a>,<\/span> we have discussed the Azure Kubernetes Service (AKS) basics, the Infrastructure as Code (IaC) mechanism with a focus on Hashicorp Terraform and how to deploy a Kubernetes cluster with AKS using Terraform.<br>With this lab, you\u2019ll go through tasks that will help you &nbsp;master the basic and more advanced topics required to secure Azure AKS Kubernetes cluster at the deployment level based on the following mechanisms and technologies:<\/p>\n\n\n\n<ol class=\"ul-black wp-block-list\"><li>\u2705Azure AD <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/fundamentals\/active-directory-whatis\" target=\"_blank\"><span style=\"text-decoration: underline;\">(AAD)<\/span><\/a><\/li><li>\u2705AKS with Role-Based Access Control<a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/\"><span style=\"text-decoration: underline;\"> (RBAC)<\/span><\/a><\/li><li>\u2705Container Network Interface <a href=\"https:\/\/github.com\/containernetworking\/cni\"><span style=\"text-decoration: underline;\">(C<\/span><\/a><span style=\"text-decoration: underline;\"><a href=\"https:\/\/github.com\/containernetworking\/cni\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"N (opens in a new tab)\">N<\/a><\/span><a href=\"https:\/\/github.com\/containernetworking\/cni\"><span style=\"text-decoration: underline;\">I)<\/span><\/a><\/li><li>\u2705Azure <span style=\"text-decoration: underline;\"><a rel=\"noreferrer noopener\" aria-label=\"Network policy (opens in a new tab)\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/aks\/use-network-policies\" target=\"_blank\">Network policy<\/a><\/span><\/li><li>\u2705Azure<span style=\"text-decoration: underline;\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/basic-concepts\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" Key Vault (opens in a new tab)\"> Key Vault<\/a><\/span><\/li><\/ol>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p>This article is part of a series:<\/p>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li><a href=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Secure AKS at the deployment: part 1 (opens in a new tab)\">Secure AKS at the deployment: part 1<\/a><\/li><li><a href=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-2\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Secure AKS at the deployment: part 2 (opens in a new tab)\"><span style=\"text-decoration: underline;\">Secure AKS at the deployment: part 2<\/span><\/a><\/li><li>Secure AKS at the deployment: part 3<\/li><\/ul>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Assumptions and Prerequisites<\/h2>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li>You have basic knowledge of&nbsp;<a rel=\"noreferrer noopener\" aria-label=\"Azure (opens in a new tab)\" href=\"https:\/\/azure.microsoft.com\/en-us\/\" target=\"_blank\">Azure<\/a><\/li><li>Have basic knowledge of&nbsp;<a rel=\"noreferrer noopener\" aria-label=\"Kubernetes (opens in a new tab)\" href=\"https:\/\/kubernetes.io\/\" target=\"_blank\">Kubernetes<\/a><\/li><li>You have&nbsp;<a rel=\"noreferrer noopener\" aria-label=\"Terraform&nbsp; (opens in a new tab)\" href=\"https:\/\/learn.hashicorp.com\/terraform\/getting-started\/install.html\" target=\"_blank\"><span style=\"text-decoration: underline;\">Terraform&nbsp;<\/span><\/a>installed in your local machine <\/li><li>You have basic experience with Terraform <\/li><li>Azure subscription: Sign up for an Azure account, if you don\u2019t own one already. You will receive USD200 in free credits.<\/li><\/ul>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Implement  Network Policies  to secure AKS at the deployment <\/h2>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/kubernetes-network-policies-overview.png\" alt=\"\" class=\"wp-image-326\" width=\"498\" height=\"450\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/kubernetes-network-policies-overview.png 439w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/kubernetes-network-policies-overview.png 300w\" sizes=\"auto, (max-width: 498px) 100vw, 498px\" \/><\/figure><\/div>\n\n\n\n<p>We saw in the first section the basics and the prerequisites to integrate Azure Active Directory authentication and RBAC management on an AKS cluster. In a second part, we continued our exploration of the use of Azure Active Directory (AAD) to secure AKS. <br><br>In this part, we finish our exploration of securing AKS by looking at Kubernetes Network Policies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-policy-options-in-aks\">1- Network policy options in AKS<\/h3>\n\n\n\n<p>Azure provides two ways to implement network policy. You choose a network policy option when you create an AKS cluster. The policy option can&#8217;t be changed after the cluster is created:<\/p>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li>Azure\u2019s own implementation, called&nbsp;<em>Azure Network Policies<\/em>.<\/li><li><em>Calico Network Policies<\/em>, an open-source network and network security solution founded by&nbsp;<a href=\"https:\/\/www.tigera.io\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Tigera (opens in a new tab)\">Tigera<\/a>.<\/li><\/ul>\n\n\n\n<p>Both implementations use Linux&nbsp;<em>IPTables<\/em>&nbsp;to enforce the specified policies. Policies are translated into sets of allowed and disallowed IP pairs. These pairs are then programmed as IPTable filter rules.<\/p>\n\n\n\n<p><strong>Differences between Azure and Calico policies and their capabilities<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table ul-black is-style-stripes\"><table class=\"has-subtle-light-gray-background-color has-fixed-layout has-background\"><thead><tr><th>Capability<\/th><th>Azure<\/th><th>Calico<\/th><\/tr><\/thead><tbody><tr><td>Supported platforms<\/td><td>Linux<\/td><td>Linux<\/td><\/tr><tr><td>Supported networking options<\/td><td>Azure CNI<\/td><td>Azure CNI and kubenet<\/td><\/tr><tr><td>Compliance with Kubernetes specification<\/td><td>All policy types supported<\/td><td>All policy types supported<\/td><\/tr><tr><td>Additional features<\/td><td>None<\/td><td>Extended policy model consisting of Global Network Policy, Global Network Set, and Host Endpoint. For more information on using the&nbsp;<code>calicoctl<\/code>&nbsp;CLI to manage these extended features, see&nbsp;<a href=\"https:\/\/docs.projectcalico.org\/v3.9\/reference\/calicoctl\/\">calicoctl user reference<\/a>.<\/td><\/tr><tr><td>Support<\/td><td>Supported by Azure support and Engineering team<\/td><td>Calico community support. For more information on additional paid support, see&nbsp;<a href=\"https:\/\/www.tigera.io\/tigera-products\/calico\/\">Project Calico support options<\/a>.<\/td><\/tr><tr><td>Logging<\/td><td>Rules added \/ deleted in IPTables are logged on every host under&nbsp;<em>\/var\/log\/azure-npm.log<\/em><\/td><td>For more information, see&nbsp;<a href=\"https:\/\/docs.projectcalico.org\/v3.9\/maintenance\/component-logs\">Calico component logs<\/a><\/td><\/tr><\/tbody><tfoot><tr><td><\/td><td><\/td><td><\/td><\/tr><\/tfoot><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">2- Proposal of Azure Network Policies in AKS<\/h3>\n\n\n\n<p>By default, the AKS cluster manages access for applications exposed outside, through the main service associated with the cluster, by using the Network Security Group associated with the NICs of the nodes in the cluster.<\/p>\n\n\n\n<p>Whenever an application is exposed outside, a public IP address is made available, with the corresponding load balancing rule.<br> It is a purely Azure IaaS filtering and the pods can always communicate with each other. <br>For added security, we use network policies that provide IP table functionality at the pod level.<\/p>\n\n\n\n<p>To see network policies in action, let&#8217;s create and then expand on a policy that defines traffic flow:<\/p>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li>Deny all traffic to pod<\/li><li>Allow traffic based on namespace.<\/li><\/ul>\n\n\n\n<p>First, you need to create an AKS cluster that supports network policy.<\/p>\n\n\n\n<p class=\"has-background has-pale-cyan-blue-background-color\">&nbsp;\u2139\ufe0f<strong> Important<\/strong><br>The network policy feature can only be enabled when the cluster is created. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3- Deny all inbound traffic to a pod<\/h3>\n\n\n\n<p>In terms of basic security, we can set up a Network Policy, applied at the time of deployment, by default blocking all incoming traffic (ingress) on a given namespace<br>You can also clearly see that traffic is dropped when the network policy is applied.<br>For the sample application environment and traffic rules, let&#8217;s first create a namespace called&nbsp;<em>development<\/em>&nbsp;to run the example pods:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.08.58-1024x114.png\" alt=\"Secure AKS at the deployment: create test ns\" class=\"wp-image-500\" width=\"590\" height=\"65\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.08.58.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.08.58.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.08.58.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.08.58.png 1346w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.08.58.png 1280w\" sizes=\"auto, (max-width: 590px) 100vw, 590px\" \/><\/figure>\n\n\n\n<p>Let\u2019s create an example back-end that runs NGINX. This back-end pod can be used to simulate a sample back-end web-based application. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07-1024x75.png\" alt=\"Secure AKS at the deployment level: example pod\" class=\"wp-image-501\" width=\"592\" height=\"43\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 2032w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 1280w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.12.07.png 1920w\" sizes=\"auto, (max-width: 592px) 100vw, 592px\" \/><\/figure>\n\n\n\n<p>Then, create another pod and attach a terminal session to test that you can successfully reach the default NGINX webpage:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33-1024x69.png\" alt=\"Second test pod\" class=\"wp-image-503\" width=\"590\" height=\"40\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33.png 1564w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.14.33.png 1280w\" sizes=\"auto, (max-width: 590px) 100vw, 590px\" \/><\/figure>\n\n\n\n<p><code>wget<\/code> &nbsp;the default NGINX webpage:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.16.33-1-1024x108.png\" alt=\"Secure AKS at the deployment accessibility test\" class=\"wp-image-505\" width=\"591\" height=\"62\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.16.33-1.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.16.33-1.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.16.33-1.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.16.33-1.png 1158w\" sizes=\"auto, (max-width: 591px) 100vw, 591px\" \/><\/figure>\n\n\n\n<p>The default NGINX webpage return a sample output such as:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.21.40-1024x139.png\" alt=\"\" class=\"wp-image-506\" width=\"561\" height=\"76\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.21.40.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.21.40.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.21.40.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.21.40.png 1240w\" sizes=\"auto, (max-width: 561px) 100vw, 561px\" \/><\/figure>\n<\/div><\/div>\n\n\n\n<p>Exit out of the attached terminal session. The test pod is automatically deleted.<\/p>\n\n\n\n<p><strong>Create and apply a network policy<\/strong><\/p>\n\n\n\n<p>Now that you&#8217;ve confirmed you can use the basic NGINX webpage on the sample back-end pod, create a network policy to deny all traffic. Create a file named&nbsp;<code>backend-policy.yaml<\/code>&nbsp;and paste the following YAML manifest. This manifest uses a&nbsp;<em>podSelector<\/em>&nbsp;to attach the policy to pods that have the&nbsp;<em>app:webapp,role:backend<\/em>&nbsp;label, like your sample NGINX pod. <\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\n<style>.gist table { margin-bottom: 0; }<\/style><div style=\"tab-size: 8\" id=\"gist100356531\" class=\"gist\">\n    <div class=\"gist-file\" translate=\"no\" data-color-mode=\"light\" data-light-theme=\"light\">\n      <div class=\"gist-data\">\n        \n<div class=\"js-gist-file-update-container js-task-list-container\">\n      <div id=\"file-backend-policy-yaml\" class=\"file my-2\">\n    \n    <div itemprop=\"text\"\n      class=\"Box-body p-0 blob-wrapper data type-yaml  \"\n      style=\"overflow: auto\" tabindex=\"0\" role=\"region\"\n      aria-label=\"backend-policy.yaml content, created by AymenSegni on 02:26AM on January 03, 2020.\"\n    >\n\n        \n<div class=\"js-check-hidden-unicode js-blob-code-container blob-code-content\">\n\n  <template class=\"js-file-alert-template\">\n  <div data-view-component=\"true\" class=\"flash flash-warn flash-full d-flex flex-items-center\">\n  <svg aria-hidden=\"true\" data-component=\"Octicon\" height=\"16\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" data-view-component=\"true\" class=\"octicon octicon-alert\">\n    <path d=\"M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\"><\/path>\n<\/svg>\n    <span>\n      This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.\n      <a class=\"Link--inTextBlock\" href=\"https:\/\/github.co\/hiddenchars\" target=\"_blank\">Learn more about bidirectional Unicode characters<\/a>\n    <\/span>\n\n\n  <div data-view-component=\"true\" class=\"flash-action\">        <a href=\"{{ revealButtonHref }}\" data-view-component=\"true\" class=\"btn-sm btn\">    Show hidden characters\n<\/a>\n<\/div>\n<\/div><\/template>\n<template class=\"js-line-alert-template\">\n  <span aria-label=\"This line has hidden Unicode characters\" data-view-component=\"true\" class=\"line-alert tooltipped tooltipped-e\">\n    <svg aria-hidden=\"true\" data-component=\"Octicon\" height=\"16\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" data-view-component=\"true\" class=\"octicon octicon-alert\">\n    <path d=\"M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\"><\/path>\n<\/svg>\n<\/span><\/template>\n\n  <table data-hpc class=\"highlight tab-size js-file-line-container\" data-tab-size=\"4\" data-paste-markdown-skip data-tagsearch-path=\"backend-policy.yaml\">\n        <tr>\n          <td id=\"file-backend-policy-yaml-L1\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"1\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC1\" class=\"blob-code blob-code-inner js-file-line\">kind: NetworkPolicy<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L2\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"2\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC2\" class=\"blob-code blob-code-inner js-file-line\">apiVersion: networking.k8s.io\/v1<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L3\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"3\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC3\" class=\"blob-code blob-code-inner js-file-line\">metadata:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L4\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"4\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC4\" class=\"blob-code blob-code-inner js-file-line\">  name: backend-policy<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L5\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"5\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC5\" class=\"blob-code blob-code-inner js-file-line\">  namespace: development<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L6\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"6\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC6\" class=\"blob-code blob-code-inner js-file-line\">spec:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L7\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"7\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC7\" class=\"blob-code blob-code-inner js-file-line\">  podSelector:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L8\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"8\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC8\" class=\"blob-code blob-code-inner js-file-line\">    matchLabels:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L9\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"9\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC9\" class=\"blob-code blob-code-inner js-file-line\">      app: webapp<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L10\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"10\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC10\" class=\"blob-code blob-code-inner js-file-line\">      role: backend<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-backend-policy-yaml-L11\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"11\"><\/td>\n          <td id=\"file-backend-policy-yaml-LC11\" class=\"blob-code blob-code-inner js-file-line\">  ingress: []<\/td>\n        <\/tr>\n  <\/table>\n<\/div>\n\n\n    <\/div>\n\n  <\/div>\n\n<\/div>\n\n      <\/div>\n      <div class=\"gist-meta\">\n        <a href=\"https:\/\/gist.github.com\/AymenSegni\/1d66e956e174bd3862c724d0ae127075\/raw\/8ec67b029a0813affb09405a68b4ec14fc374f6d\/backend-policy.yaml\" style=\"float:right\" class=\"Link--inTextBlock\">view raw<\/a>\n        <a href=\"https:\/\/gist.github.com\/AymenSegni\/1d66e956e174bd3862c724d0ae127075#file-backend-policy-yaml\" class=\"Link--inTextBlock\">\n          backend-policy.yaml\n        <\/a>\n        hosted with &#10084; by <a class=\"Link--inTextBlock\" href=\"https:\/\/github.com\">GitHub<\/a>\n      <\/div>\n    <\/div>\n<\/div>\n\n<\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"99\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.28.21-1024x99.png\" alt=\"kubctl apply\" class=\"wp-image-508\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.28.21.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.28.21.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.28.21.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.28.21.png 1184w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p><strong>Test the network policy<\/strong><\/p>\n\n\n\n<p>Let&#8217;s see if you can use the NGINX webpage on the back-end pod again. Create another test pod and attach a terminal session:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29-1024x68.png\" alt=\"\" class=\"wp-image-509\" width=\"592\" height=\"39\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29.png 1540w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.31.29.png 1280w\" sizes=\"auto, (max-width: 592px) 100vw, 592px\" \/><\/figure>\n\n\n\n<p>use&nbsp;<code>wget<\/code>&nbsp;to see if you can access the default NGINX webpage. This time, set a timeout value to&nbsp;<em>2<\/em>&nbsp;seconds. The network policy now blocks all inbound traffic, so the page can&#8217;t be loaded, as shown in the following example:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.33.08-1024x125.png\" alt=\"Secure AKS at the deployment \" class=\"wp-image-510\" width=\"592\" height=\"71\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.33.08.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.33.08.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.33.08.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.33.08.png 1176w\" sizes=\"auto, (max-width: 592px) 100vw, 592px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">4- Allow traffic only from within a defined namespace<\/h3>\n\n\n\n<p>In the previous examples, you created a network policy that denied all traffic. Another common need is to limit traffic to only within a given namespace. If the previous examples were for traffic in a&nbsp;<em>development<\/em>&nbsp;namespace, create a network policy that prevents traffic from another namespace, such as&nbsp;<em>production<\/em>, from reaching the pods.<\/p>\n\n\n\n<p>First, create a new namespace to simulate a production namespace:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.37.51-1024x123.png\" alt=\"\" class=\"wp-image-511\" width=\"591\" height=\"70\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.37.51.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.37.51.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.37.51.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.37.51.png 1184w\" sizes=\"auto, (max-width: 591px) 100vw, 591px\" \/><\/figure>\n\n\n\n<p>Schedule a test pod in the&nbsp;<em>production<\/em>&nbsp;namespace that is labeled as&nbsp;<em>app=webapp,role=frontend<\/em>. Attach a terminal session:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00-1024x66.png\" alt=\"\" class=\"wp-image-512\" width=\"591\" height=\"38\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00.png 1968w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.40.00.png 1280w\" sizes=\"auto, (max-width: 591px) 100vw, 591px\" \/><\/figure>\n\n\n\n<p class=\"has-text-color has-background has-very-light-gray-color has-very-dark-gray-background-color\">kubectl run &#8211;rm -it frontend &#8211;image=alpine &#8211;labels app=webapp,role=frontend &#8211;namespace production &#8211;generator=run-pod\/v1<\/p>\n\n\n\n<p>Then, use&nbsp;<code>wget<\/code>&nbsp;to confirm that you can access the default NGINX webpage:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"78\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.43.19-1024x78.png\" alt=\"\" class=\"wp-image-515\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.43.19.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.43.19.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.43.19.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.43.19.png 1206w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p>The network policy doesn&#8217;t look at the namespaces, only the pod labels. The following example output shows the default NGINX webpage returned:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-very-light-gray-color has-very-dark-gray-background-color\">&lt;title&gt;Welcome to nginx!&lt;\/title&gt; [&#8230;]<\/p>\n\n\n\n<p>Exit out of the attached terminal session. The test pod is automatically deleted.<\/p>\n\n\n\n<p><strong>Update the network policy<\/strong><\/p>\n\n\n\n<p>Let&#8217;s update the ingress rule&nbsp;<em>namespaceSelector<\/em>&nbsp;section to only allow traffic from within the&nbsp;<em>development<\/em>&nbsp;namespace. Edit the&nbsp;<em>backend-policy.yaml<\/em>&nbsp;manifest file as shown in the following example:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\n<style>.gist table { margin-bottom: 0; }<\/style><div style=\"tab-size: 8\" id=\"gist100356698\" class=\"gist\">\n    <div class=\"gist-file\" translate=\"no\" data-color-mode=\"light\" data-light-theme=\"light\">\n      <div class=\"gist-data\">\n        \n<div class=\"js-gist-file-update-container js-task-list-container\">\n      <div id=\"file-allow-trafic-backend-policy-yaml\" class=\"file my-2\">\n    \n    <div itemprop=\"text\"\n      class=\"Box-body p-0 blob-wrapper data type-yaml  \"\n      style=\"overflow: auto\" tabindex=\"0\" role=\"region\"\n      aria-label=\"allow-trafic-backend-policy.yaml content, created by AymenSegni on 02:46AM on January 03, 2020.\"\n    >\n\n        \n<div class=\"js-check-hidden-unicode js-blob-code-container blob-code-content\">\n\n  <template class=\"js-file-alert-template\">\n  <div data-view-component=\"true\" class=\"flash flash-warn flash-full d-flex flex-items-center\">\n  <svg aria-hidden=\"true\" data-component=\"Octicon\" height=\"16\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" data-view-component=\"true\" class=\"octicon octicon-alert\">\n    <path d=\"M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\"><\/path>\n<\/svg>\n    <span>\n      This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.\n      <a class=\"Link--inTextBlock\" href=\"https:\/\/github.co\/hiddenchars\" target=\"_blank\">Learn more about bidirectional Unicode characters<\/a>\n    <\/span>\n\n\n  <div data-view-component=\"true\" class=\"flash-action\">        <a href=\"{{ revealButtonHref }}\" data-view-component=\"true\" class=\"btn-sm btn\">    Show hidden characters\n<\/a>\n<\/div>\n<\/div><\/template>\n<template class=\"js-line-alert-template\">\n  <span aria-label=\"This line has hidden Unicode characters\" data-view-component=\"true\" class=\"line-alert tooltipped tooltipped-e\">\n    <svg aria-hidden=\"true\" data-component=\"Octicon\" height=\"16\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" data-view-component=\"true\" class=\"octicon octicon-alert\">\n    <path d=\"M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\"><\/path>\n<\/svg>\n<\/span><\/template>\n\n  <table data-hpc class=\"highlight tab-size js-file-line-container\" data-tab-size=\"4\" data-paste-markdown-skip data-tagsearch-path=\"allow-trafic-backend-policy.yaml\">\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L1\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"1\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC1\" class=\"blob-code blob-code-inner js-file-line\">kind: NetworkPolicy<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L2\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"2\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC2\" class=\"blob-code blob-code-inner js-file-line\">apiVersion: networking.k8s.io\/v1<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L3\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"3\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC3\" class=\"blob-code blob-code-inner js-file-line\">metadata:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L4\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"4\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC4\" class=\"blob-code blob-code-inner js-file-line\">  name: backend-policy<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L5\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"5\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC5\" class=\"blob-code blob-code-inner js-file-line\">  namespace: development<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L6\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"6\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC6\" class=\"blob-code blob-code-inner js-file-line\">spec:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L7\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"7\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC7\" class=\"blob-code blob-code-inner js-file-line\">  podSelector:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L8\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"8\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC8\" class=\"blob-code blob-code-inner js-file-line\">    matchLabels:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L9\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"9\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC9\" class=\"blob-code blob-code-inner js-file-line\">      app: webapp<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L10\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"10\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC10\" class=\"blob-code blob-code-inner js-file-line\">      role: backend<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L11\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"11\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC11\" class=\"blob-code blob-code-inner js-file-line\">  ingress:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L12\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"12\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC12\" class=\"blob-code blob-code-inner js-file-line\">  &#8211; from:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L13\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"13\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC13\" class=\"blob-code blob-code-inner js-file-line\">    &#8211; namespaceSelector:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L14\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"14\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC14\" class=\"blob-code blob-code-inner js-file-line\">        matchLabels:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L15\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"15\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC15\" class=\"blob-code blob-code-inner js-file-line\">          purpose: development<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L16\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"16\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC16\" class=\"blob-code blob-code-inner js-file-line\">      podSelector:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L17\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"17\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC17\" class=\"blob-code blob-code-inner js-file-line\">        matchLabels:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L18\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"18\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC18\" class=\"blob-code blob-code-inner js-file-line\">          app: webapp<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-allow-trafic-backend-policy-yaml-L19\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"19\"><\/td>\n          <td id=\"file-allow-trafic-backend-policy-yaml-LC19\" class=\"blob-code blob-code-inner js-file-line\">          role: frontend<\/td>\n        <\/tr>\n  <\/table>\n<\/div>\n\n\n    <\/div>\n\n  <\/div>\n\n<\/div>\n\n      <\/div>\n      <div class=\"gist-meta\">\n        <a href=\"https:\/\/gist.github.com\/AymenSegni\/f9c5902fa54e043c37018f72ce7c5111\/raw\/de61469865c8e712690df1437a293cb5955bd43f\/allow-trafic-backend-policy.yaml\" style=\"float:right\" class=\"Link--inTextBlock\">view raw<\/a>\n        <a href=\"https:\/\/gist.github.com\/AymenSegni\/f9c5902fa54e043c37018f72ce7c5111#file-allow-trafic-backend-policy-yaml\" class=\"Link--inTextBlock\">\n          allow-trafic-backend-policy.yaml\n        <\/a>\n        hosted with &#10084; by <a class=\"Link--inTextBlock\" href=\"https:\/\/github.com\">GitHub<\/a>\n      <\/div>\n    <\/div>\n<\/div>\n\n<\/div><\/figure>\n\n\n\n<p>Apply the updated network policy:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.49.53-1024x109.png\" alt=\"Secure AKS at the deployment: apply network policy \" class=\"wp-image-517\" width=\"591\" height=\"62\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.49.53.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.49.53.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.49.53.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.49.53.png 1166w\" sizes=\"auto, (max-width: 591px) 100vw, 591px\" \/><\/figure>\n\n\n\n<p><strong>Test the updated network policy<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34-1024x73.png\" alt=\"\" class=\"wp-image-518\" width=\"595\" height=\"42\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34.png 1968w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.52.34.png 1280w\" sizes=\"auto, (max-width: 595px) 100vw, 595px\" \/><\/figure>\n\n\n\n<p class=\"has-text-color has-background has-very-light-gray-color has-very-dark-gray-background-color\">kubectl run &#8211;rm -it frontend &#8211;image=alpine &#8211;labels app=webapp,role=frontend &#8211;namespace development &#8211;generator=run-pod\/v1<\/p>\n\n\n\n<p>To see that the network policy allows the traffic:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-very-light-gray-color has-very-dark-gray-background-color\">wget -qO- http:\/\/backend<\/p>\n\n\n\n<p>Traffic is allowed because the pod is scheduled in the namespace that matches what&#8217;s permitted in the network policy.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"185\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.55.37-1024x185.png\" alt=\"Secure AKS at the deployment network policy succeeded \" class=\"wp-image-519\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.55.37.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.55.37.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.55.37.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Screenshot-2020-01-03-at-03.55.37.png 1140w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Conclusion <\/h2>\n\n\n\n<p>In this article, we have looked at the capabilities of Kubernetes Network Policies, which complement the security of an AKS cluster, at a glance. Other features are coming on AKS such as AAD Pod Identities that allows pods authentication on Azure, or private clusters to avoid exposure of Kubernetes APIs on a public url. <\/p>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\" id=\"that-s-all-folks-\">That&#8217;s all folks!<\/h2>\n\n\n\n<p>That\u2019s all for this workshop, thanks for reading! Later posts may cover best practices for running  fully configured cluster with hundreds of microservices deployed in one click!<\/p>\n\n\n\n<p>Be the first to be notified when a new article, running it on Cloud or Kubernetes experiment is published.<br>Don&#8217;t miss the next article!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform<\/p>\n","protected":false},"author":1,"featured_media":461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9,13,8,10,12],"tags":[14,11,17,19,6,2,15,16],"class_list":["post-441","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-deployment","category-devops","category-kubernetes","category-security","tag-aks","tag-azure","tag-cloud","tag-deployment","tag-devops","tag-kubernetes","tag-security","tag-terraform"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.0 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Secure AKS at the deployment - part 3 - Run It On Cloud<\/title>\n<meta name=\"description\" content=\"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Secure AKS at the deployment - part 3 - Run It On Cloud\" \/>\n<meta property=\"og:description\" content=\"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform\" \/>\n<meta property=\"og:url\" content=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\" \/>\n<meta property=\"og:site_name\" content=\"Run It On Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-03T03:25:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-01-03T03:41:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Kubernetes-Security-600x400_1554495004.png?fit=600%2C400&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"aymen-segni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/x.com\/axsegni\" \/>\n<meta name=\"twitter:site\" content=\"@axsegni\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"aymen-segni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\"},\"author\":{\"name\":\"aymen-segni\",\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\"},\"headline\":\"Secure AKS at the deployment &#8211; part 3 &#8211;\",\"datePublished\":\"2020-01-03T03:25:26+00:00\",\"dateModified\":\"2020-01-03T03:41:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\"},\"wordCount\":1375,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\"},\"keywords\":[\"aks\",\"Azure\",\"cloud\",\"deployment\",\"devops\",\"kubernetes\",\"security\",\"terraform\"],\"articleSection\":[\"Cloud\",\"Deployment\",\"Devops\",\"Kubernetes\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\",\"url\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\",\"name\":\"Secure AKS at the deployment - part 3 - Run It On Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/aymen-segni.com\/#website\"},\"datePublished\":\"2020-01-03T03:25:26+00:00\",\"dateModified\":\"2020-01-03T03:41:12+00:00\",\"description\":\"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform\",\"breadcrumb\":{\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/aymen-segni.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Secure AKS at the deployment &#8211; part 3 &#8211;\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/aymen-segni.com\/#website\",\"url\":\"https:\/\/aymen-segni.com\/\",\"name\":\"Run It On Cloud\",\"description\":\"Accelerate your Cloud &amp; MLOps Journey\",\"publisher\":{\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/aymen-segni.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\",\"name\":\"aymen-segni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg\",\"contentUrl\":\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg\",\"width\":896,\"height\":1152,\"caption\":\"aymen-segni\"},\"logo\":{\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/\"},\"description\":\"Staff Engineer with over a decade of experience in building, scaling, and leading MLOPS, Cloud Native, SRE, and DevOps platforms across high-growth and enterprise environments. I specialize in architecting production-grade systems with a strong emphasis on resilience, security, and developer experience; bringing together deep expertise in distributed systems, Kubernetes, and modern platform engineering to empower engineering teams and accelerate business value. My work spans Cloud (AWS, GCP, Azure, OpenStack), Kubernetes, SRE (SLOs, observability, incident response), AI infrastructure and AgentOps (vLLM, Nvidia, RayServe, etc), and Platform Engineering (Backstage, Keptn, GitOps, self-service). I\u2019ve led teams through Cloud Native transformations, established scalable SRE practices, and built internal platforms that streamline operations and reduce cognitive load. With a strong programming background, and Infrastructure as Code (Terraform, Helm, Ansible), I drive automation-first approaches to eliminate toil, ensure reliability, and enable secure, compliant deployment pipelines. My focus today is on building Cloud Native AI platforms, where DevOps meets AI Infrastructure Stacks to support scalable, production-ready LLMs and AI Platforms. As a dedicated mentor, both within my teams and through platforms like MentorCruise, I am passionate about helping engineers perform at their best and assisting organizations in scaling with confidence. Driven by systems thinking, platform-as-a-product mindset, and engineering excellence, I help teams ship faster, operate smarter, and scale with confidence.\",\"sameAs\":[\"https:\/\/aymen-segni.com\",\"https:\/\/www.linkedin.com\/in\/aymen-segni\",\"https:\/\/twitter.com\/https:\/\/x.com\/axsegni\"],\"url\":\"https:\/\/aymen-segni.com\/index.php\/author\/admin8647\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Secure AKS at the deployment - part 3 - Run It On Cloud","description":"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/","og_locale":"en_US","og_type":"article","og_title":"Secure AKS at the deployment - part 3 - Run It On Cloud","og_description":"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform","og_url":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/","og_site_name":"Run It On Cloud","article_published_time":"2020-01-03T03:25:26+00:00","article_modified_time":"2020-01-03T03:41:12+00:00","og_image":[{"width":600,"height":400,"url":"https:\/\/i0.wp.com\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Kubernetes-Security-600x400_1554495004.png?fit=600%2C400&ssl=1","type":"image\/png"}],"author":"aymen-segni","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/x.com\/axsegni","twitter_site":"@axsegni","twitter_misc":{"Written by":"aymen-segni","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#article","isPartOf":{"@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/"},"author":{"name":"aymen-segni","@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d"},"headline":"Secure AKS at the deployment &#8211; part 3 &#8211;","datePublished":"2020-01-03T03:25:26+00:00","dateModified":"2020-01-03T03:41:12+00:00","mainEntityOfPage":{"@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/"},"wordCount":1375,"commentCount":2,"publisher":{"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d"},"keywords":["aks","Azure","cloud","deployment","devops","kubernetes","security","terraform"],"articleSection":["Cloud","Deployment","Devops","Kubernetes","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/","url":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/","name":"Secure AKS at the deployment - part 3 - Run It On Cloud","isPartOf":{"@id":"https:\/\/aymen-segni.com\/#website"},"datePublished":"2020-01-03T03:25:26+00:00","dateModified":"2020-01-03T03:41:12+00:00","description":"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform","breadcrumb":{"@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/aymen-segni.com\/"},{"@type":"ListItem","position":2,"name":"Secure AKS at the deployment &#8211; part 3 &#8211;"}]},{"@type":"WebSite","@id":"https:\/\/aymen-segni.com\/#website","url":"https:\/\/aymen-segni.com\/","name":"Run It On Cloud","description":"Accelerate your Cloud &amp; MLOps Journey","publisher":{"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/aymen-segni.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d","name":"aymen-segni","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/","url":"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg","contentUrl":"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg","width":896,"height":1152,"caption":"aymen-segni"},"logo":{"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/"},"description":"Staff Engineer with over a decade of experience in building, scaling, and leading MLOPS, Cloud Native, SRE, and DevOps platforms across high-growth and enterprise environments. I specialize in architecting production-grade systems with a strong emphasis on resilience, security, and developer experience; bringing together deep expertise in distributed systems, Kubernetes, and modern platform engineering to empower engineering teams and accelerate business value. My work spans Cloud (AWS, GCP, Azure, OpenStack), Kubernetes, SRE (SLOs, observability, incident response), AI infrastructure and AgentOps (vLLM, Nvidia, RayServe, etc), and Platform Engineering (Backstage, Keptn, GitOps, self-service). I\u2019ve led teams through Cloud Native transformations, established scalable SRE practices, and built internal platforms that streamline operations and reduce cognitive load. With a strong programming background, and Infrastructure as Code (Terraform, Helm, Ansible), I drive automation-first approaches to eliminate toil, ensure reliability, and enable secure, compliant deployment pipelines. My focus today is on building Cloud Native AI platforms, where DevOps meets AI Infrastructure Stacks to support scalable, production-ready LLMs and AI Platforms. As a dedicated mentor, both within my teams and through platforms like MentorCruise, I am passionate about helping engineers perform at their best and assisting organizations in scaling with confidence. Driven by systems thinking, platform-as-a-product mindset, and engineering excellence, I help teams ship faster, operate smarter, and scale with confidence.","sameAs":["https:\/\/aymen-segni.com","https:\/\/www.linkedin.com\/in\/aymen-segni","https:\/\/twitter.com\/https:\/\/x.com\/axsegni"],"url":"https:\/\/aymen-segni.com\/index.php\/author\/admin8647\/"}]}},"jetpack_featured_media_url":"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Kubernetes-Security-600x400_1554495004.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts\/441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/comments?post=441"}],"version-history":[{"count":25,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts\/441\/revisions"}],"predecessor-version":[{"id":535,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts\/441\/revisions\/535"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/media\/461"}],"wp:attachment":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/media?parent=441"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/categories?post=441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/tags?post=441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}