Network Policies

Overview

Network policies restrict pod-to-pod communication in Kubernetes using least-privilege traffic rules.

Policy Goals

• Deny unnecessary east-west traffic
• Allow only required service paths
• Segment workloads by namespace and label

flowchart LR
    A[Frontend Pod] -->|allowed| B[API Pod]
    A -. denied .-> C[Database Pod]

Practical Example

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-only
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend

Production Example

Platform teams commonly apply a default deny policy and then grant explicit allow rules for known service dependencies.

Common Pitfalls

• Assuming policies work without compatible CNI plugin support
• Missing egress restrictions
• Broad label selectors that bypass segmentation intent

Key Takeaways

• Network policies reduce lateral movement risk.
• Default deny plus explicit allow is an effective baseline.
• Policy testing should be part of deployment validation.