Day 60: NetworkPolicies
Kubernetes networking is open by default
By default, any Pod can reach any other Pod in the cluster — there's no implicit isolation. A NetworkPolicy is a firewall rule scoped to Pods (selected by label), restricting which traffic is allowed in (ingress) or out (egress).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: db-allow-api-only
spec:
podSelector:
matchLabels: { app: db }
policyTypes: [Ingress]
ingress:
- from:
- podSelector: { matchLabels: { app: api } }
ports:
- port: 5432NetworkPolicies require CNI support
A NetworkPolicy object, like Ingress, is inert without a CNI plugin that actually enforces it — not every CNI does (tomorrow's Day 61 covers which ones). Applying policies without checking this gives a false sense of security.
This is Phase 7's default-deny principle applied to networking
A "default deny" NetworkPolicy (selecting all pods, allowing nothing, then adding explicit allow rules) is the network-layer analogue of least-privilege capabilities from Phase 6 — deny everything, then explicitly allow only what's needed.
Key terms
- NetworkPolicy
- A Pod-scoped firewall rule restricting ingress/egress traffic by label selector.
- Default deny
- A NetworkPolicy pattern that blocks all traffic by default, requiring explicit allow rules.
You apply a NetworkPolicy but traffic is unaffected — every Pod can still reach every other Pod. What's the likely cause?
