Security Identity for N/S Service Traffic
When accessing a Kubernetes service from outside the cluster, the Identity-Based assignment depends on the routing mode.
In the tunneling mode (i.e.,
--tunnel-protocol=geneve), the request
to the service will have the
reserved:world security identity.
In the native-routing mode (i.e.,
--routing-mode=native), the security identity
will be set to the
reserved:world if the request was sent to the node which runs the
selected endpoint by the LB. If not, i.e., the request needs to be forwarded to
another node after the service endpoint selection, then it will have the
The latter traffic will match
fromEntities: cluster policies.
Differences From Kubernetes Network Policies
When creating Cilium Network Policies it is important to keep in mind that Cilium Network Policies do not perfectly replicate the functionality of Kubernetes Network Policies. See this table for differences.