Handbooks / Kubernetes / Chapter 8
NetworkPolicies
7 pages · ~5 min✓ Reviewed
Builds on Scheduling: Taints, Tolerations and Affinity. Next up: Pod Security and Observability.
Network Policies: What and Why
1. Default and Definition
- Default is allow-all: every pod reaches every pod, in any namespace
- No policy = no restriction
- A NetworkPolicy is a namespaced allow-list firewall
- Works at L3/L4: IP, port, protocol
- Applies to pods chosen by a selector
2. Additive and Allow-Only
- Policies only allow; there are no deny rules
- Policies are additive: the union of all allows applies
- Once any policy selects a pod, unmatched traffic is dropped for that direction
- Policies are stateful: replies to allowed connections pass automatically
| Pod state | Result |
|---|---|
| Selected by no policy | All traffic open |
Selected, Ingress listed | Only listed inbound allowed |
Selected, Egress not listed | Outbound still open |
3. Isolation per Direction
- Pod is isolated for ingress or egress only if a selecting policy lists that policyType
- Unselected pods stay open
yaml
kind: NetworkPolicy
spec:
podSelector:
matchLabels: {app: api}
policyTypes: [Ingress]api pods: inbound isolated, outbound still open