Network Policies

Luke Hebert

- 2 minutes read - 306 words

Policies control Ingress and Egress traffic to pods using matchLabel selectors. You must specify the policy type, and you can scope rules to a namespace or allow specific IP addresses. Understanding how rule layout affects AND/OR logic and how policyTypes governs Egress behavior is key to writing effective policies.

How Policies Work

Policies control Ingress and Egress traffic to pods using matchLabel selectors. You must provide the policy type.

These can be scoped to a namespace by using a matchLabel selector under the ingress section along with a namespaceSelector instead of a podSelector. If you remove the podSelector, the rule will apply to all pods in the namespace.

You can also allow specific IP addresses by using ipBlock and a CIDR address.

Building Rule Sets

Note

Use care when building rule sets. How you lay out the sections under from and to can affect whether the rule is an AND or OR condition. Each rule starts with a - to indicate a new position in the list.

For example, if you only provide Ingress:

  • Ingress traffic on the selected pod will be controlled (in).
  • Egress traffic will be unaffected (out).

If you want to control traffic in both directions, you will need to specify both types in the policy.

Don’t overthink it! Only create policies for the pods you actually need to protect, as traffic is otherwise allowed across all pods in the cluster.

Egress Behavior

  1. If Egress is not specified under policyTypes, it will be fully open.
  2. If Egress is specified under policyTypes but no actual policy is defined, it will only allow responses to an established Ingress connection (similar to a stateful firewall).
  3. If Egress is specified under policyTypes and has a defined policy, it will allow traffic as defined in that policy, plus responses to established Ingress connections (similar to a stateful firewall).