Security for applications hosted in kubernetes ingress

Question

I need to host the frontend and backend parts of my application on ingress kubernetes. I would like only the frontend part to be sent to the backend part, even though both are available in ingress under one host (but a different path). Is it possible to set something like this in a kubernetes cluster? So that no other applications can send requests to the backend part. Can you do something like this with kubernetes security headers?

Answer 1

Within the cluster, you can restrict traffic between services by using Network Policies . Eg you can declare that service A can send traffic to service B, but that service C can not send traffic to service B. However, you need to make sure that your cluster has a CNI with support for Network Policies. Calico is an example for such add-on.

Ingress is useful for declaring what services can receive traffic from outside of the cluster.

Also, Service Meshes, like Istio is useful for further enhance this security. Eg by using an Egress proxy, mTLS and require JWT based authentication between services.