Cloud Intermediate
Kubernetes Network Policies¶
KubernetesNetwork PolicySecurity 3 min read
Network firewall in Kubernetes. Ingress and egress rules, namespace isolation.
Default Deny¶
# Lock everything — default deny
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: production
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
Selective Allow¶
# Allow traffic only from frontend to API
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-api
spec:
podSelector:
matchLabels: {app: api}
ingress:
- from:
- podSelector:
matchLabels: {app: frontend}
ports:
- {protocol: TCP, port: 8080}
Summary¶
Network Policies = microsegmentation in K8s. Start with default deny, then allow explicitly.
Need Help with Implementation?¶
Our team has experience designing and implementing modern architectures. We’re happy to help.