Block and allow specific URLs from EKS namespace

To control L7 traffic (application layer) in Amazon EKS, including blocking and allowing specific URLs from different namespaces, you'll need to use a service mesh or an ingress controller that supports L7 traffic management. Network policies alone are not sufficient for this level of control, as they operate at L3-L4 (IP and port level).

For your specific use case of controlling access to different URLs from prod and dev namespaces, you can implement this using a service mesh like Istio or AWS App Mesh. These tools provide more granular control over traffic at the application layer.

Here's a general approach to achieve this:

1. Deploy a service mesh (e.g., Istio) in your EKS cluster.

2. Configure the service mesh to intercept all outbound traffic from your pods.

3. Create custom resources (e.g., VirtualService and DestinationRule in Istio) to define traffic routing rules based on the source namespace and destination URL.

4. For the prod namespace, create a rule that allows traffic only to example.com and denies all other external traffic.

5. For the dev namespace, create a similar rule allowing traffic only to dev-example.com.

6. Implement a default deny rule for all other traffic.

This approach allows you to control access based on URLs rather than IP addresses, which is beneficial when the IP addresses of the target services may change. The service mesh will handle the DNS resolution and routing based on the hostnames you specify in your rules.

Keep in mind that implementing a service mesh adds complexity to your cluster and may require additional resources. However, it provides powerful capabilities for fine-grained traffic control, including the ability to manage L7 traffic based on URLs, headers, and other application-level attributes.

Remember to thoroughly test your configuration in a non-production environment before applying it to your production workloads, as misconfiguration could potentially disrupt your application's connectivity.
Sources
Network security - Amazon EKS