🛡 Kubernetes Network Policies Cheat Sheet
📌 What are Network Policies?
Network Policies in Kubernetes control inbound and outbound traffic to and from pods, helping enforce security rules at the network level.
🔹 Basic Commands
- List all network policies:
sh kubectl get networkpolicy -A - Describe a network policy:
sh kubectl describe networkpolicy <policy-name> -n <namespace> - Delete a network policy:
sh kubectl delete networkpolicy <policy-name> -n <namespace>
🔹 Default Deny All Traffic
- Deny all ingress and egress traffic for a namespace:
```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all
namespace: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress ```
🔹 Allow All Ingress Traffic
- Allow all inbound traffic to all pods in a namespace:
```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-ingress
namespace: default
spec:
podSelector: {}
policyTypes:
- Ingress ingress:
- {} # Allow all traffic ```
🔹 Allow Only From Specific Pods
- Allow ingress only from pods labeled
role=frontend: ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-from-frontend namespace: default spec: podSelector: matchLabels: app: backend policyTypes:- Ingress ingress:
- from:
- podSelector: matchLabels: role: frontend ```
🔹 Allow Traffic Only From a Specific Namespace
- Allow ingress only from pods in the
frontendnamespace: ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-from-namespace namespace: default spec: podSelector: matchLabels: app: backend policyTypes:- Ingress ingress:
- from:
- namespaceSelector: matchLabels: name: frontend ```
🔹 Restrict Egress to Specific CIDR
- Allow egress only to
10.0.0.0/24subnet: ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: restrict-egress-cidr namespace: default spec: podSelector: matchLabels: app: backend policyTypes:- Egress egress:
- to:
- ipBlock: cidr: 10.0.0.0/24 ```
🔹 Allow Egress to a Specific Service
- Allow egress to a service within the same namespace:
```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-egress-to-service
namespace: default
spec:
podSelector:
matchLabels:
app: backend
policyTypes:
- Egress egress:
- to:
- podSelector: matchLabels: app: database ```
🔥 Tips for Network Policies in Kubernetes
✅ Network Policies are namespaced – they only apply within a single namespace.
✅ Policies are deny-by-default when defined, unless explicitly allowing traffic.
✅ Use kubectl exec with curl or netcat to test policy rules.
✅ Policies only work with network plugins that support NetworkPolicy (e.g., Calico, Cilium, Weave, etc.).
✅ Always test your policies before applying them in production!