Kubernetes network policies: default deny and allowing only needed traffic

The default is wide open

Kubernetes gives every pod an IP address and, out of the box, lets any pod connect to any other pod in any namespace. If an attacker compromises one web pod, they can scan and reach databases, internal APIs and monitoring tools across the cluster. A NetworkPolicy is a Kubernetes object that restricts this, using labels to select pods.

Policies are enforced by the Container Network Interface (CNI) plugin, not by Kubernetes itself. Calico, Cilium and most managed-cloud network options support them, but a few basic plugins do not. If your CNI ignores policies, applying them silently does nothing, so always test.

How policies work

• A policy selects pods with podSelector. Once any policy selects a pod for ingress (or egress), that direction becomes deny-by-default for that pod, and only listed traffic is allowed.
• Rules can allow traffic from or to other pods (podSelector), namespaces (namespaceSelector) or IP ranges (ipBlock), on given ports.
• Policies are additive: if several apply, the union of their allows is permitted.
• Standard NetworkPolicy works at layers 3 and 4. Some CNIs add layer 7 rules, DNS-name rules or cluster-wide policies through their own resources.

Default deny, then allow

Start each application namespace with a policy that denies all ingress and egress:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: shop
spec:
  podSelector: {}
  policyTypes: ["Ingress", "Egress"]

Denying egress also blocks DNS, so almost every namespace needs a rule allowing UDP and TCP port 53 to the cluster DNS pods. Then add specific allows, such as letting the API pods reach the database on its port:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-allow-api
  namespace: shop
spec:
  podSelector:
    matchLabels: { app: db }
  policyTypes: ["Ingress"]
  ingress:
  - from:
    - podSelector:
        matchLabels: { app: api }
    ports:
    - protocol: TCP
      port: 5432

Designing policies

1. Map the real flows for each app, using CNI flow logs or observability tools where available.
2. Label pods consistently (for example app and tier), because policies depend on labels.
3. Apply default deny per namespace, plus a DNS allow.
4. Add allow rules tier by tier and test each one.
5. Restrict egress to the internet, and block the cloud metadata address (169.254.169.254) for pods that do not need it.
6. Keep policies in git and review them like code.

Tip: this is the cluster version of the segmentation ideas in zero trust segmentation: deny by default and allow by identity, not by network location.