Without network policies, every pod can communicate with every other pod. Default deny + explicit allow is the foundation.
Default Deny¶
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: [Ingress, Egress]
Allowing Specific Communication¶
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-api spec: podSelector: matchLabels: app: api ingress: - from: - podSelector: matchLabels: app: frontend ports: - port: 8080 egress: - to: - podSelector: matchLabels: app: postgres ports: - port: 5432
Key Takeaway¶
Default deny all, then allow explicitly. Requires CNI plugin (Calico, Cilium).
securitykubernetesnetwork policy