Bits of .NET

🛡️ Network Policies = Cluster Security

Default is allow all. Network Policies control traffic. Zero trust, micro-segmentation, security.

📝 Network Policy Basics

# Deny all (Default deny)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: deny-all
spec:
    podSelector: {}
    policyTypes:
    - Ingress
    - Egress

# Allow specific ingress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-nginx
spec:
    podSelector:
        matchLabels:
            app: web
    policyTypes:
    - Ingress
    ingress:
    - from:
        - podSelector:
            matchLabels:
                app: frontend
        ports:
        - protocol: TCP
            port: 80

# Allow egress to database
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-db-egress
spec:
    podSelector:
        matchLabels:
            app: api
    policyTypes:
    - Egress
    egress:
    - to:
        - podSelector:
            matchLabels:
                app: database
        ports:
        - protocol: TCP
            port: 5432

🎯 Advanced Policies

# Multi-tier application
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: multi-tier
spec:
    podSelector:
        matchLabels:
            app: api
    policyTypes:
    - Ingress
    - Egress
    ingress:
    - from:
        - podSelector:
            matchLabels:
                tier: web
        - namespaceSelector:
            matchLabels:
                name: monitoring
        ports:
        - port: 8080
    egress:
    - to:
        - podSelector:
            matchLabels:
                app: database
        ports:
        - port: 5432

# Allow external traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-external
spec:
    podSelector:
        matchLabels:
            app: web
    policyTypes:
    - Ingress
    ingress:
    - from:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
            - 192.168.1.0/24
        ports:
        - port: 80

# DNS egress (allow DNS lookups)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-dns
spec:
    podSelector:
        matchLabels:
            app: myapp
    policyTypes:
    - Egress
    egress:
    - to:
        - namespaceSelector: {}
        ports:
        - protocol: UDP
            port: 53

💡 Network Policy Tips

• Start with deny-all
• Enable gradually (least privilege)
• Test policies carefully
• Use namespaces for isolation
• Monitor policy enforcement