Network Policy in Kubernetes: A Comprehensive Guide for DevOps

Introduction

Network Policies are Kubernetes resources that control pod-to-pod communication within a cluster. They act as a firewall, enabling fine-grained control over how pods communicate with each other and external endpoints.

Key Concepts

Pod Selection

Network policies use labels to select pods and define rules. Two key selectors:

• podSelector: Defines which pods the policy applies to


• namespaceSelector: Filters pods based on their namespace

Policy Types

• Ingress: Controls incoming traffic


• Egress: Controls outgoing traffic

Default Behavior

By default, pods accept traffic from any source. Once a Network Policy selects a pod, it denies all traffic not explicitly allowed by that policy.

Common Network Policy Patterns

1. Deny All Traffic

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: default-deny

  namespace: prod

spec:

  podSelector: {}

  policyTypes:

  - Ingress

  - Egress

2. Allow Traffic from Specific Namespace

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: allow-from-dev

  namespace: prod

spec:

  podSelector:

    matchLabels:

      app: web

  policyTypes:

  - Ingress

  ingress:

  - from:

    - namespaceSelector:

        matchLabels:

          environment: dev

3. Allow Specific Port Access

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: allow-api-access

spec:

  podSelector:

    matchLabels:

      app: api

  policyTypes:

  - Ingress

  ingress:

  - ports:

    - protocol: TCP

      port: 8080

    from:

    - podSelector:

        matchLabels:

          role: frontend

4. Allow External Traffic

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: allow-external-traffic

spec:

  podSelector:

    matchLabels:

      app: web

  policyTypes:

  - Ingress

  ingress:

  - from:

    - ipBlock:

        cidr: 172.17.0.0/16

        except:

        - 172.17.1.0/24

Best Practices

1. Isolation Strategy

• Start with deny-all policies


• Gradually add allow rules based on requirements


• Use namespaces for logical grouping


• Label pods consistently

2. Security Considerations

• Implement least privilege access


• Regular audit of network policies


• Document policy intentions


• Use network policy logs for troubleshooting

3. Performance Impact

• Minimize complex selectors


• Use efficient CIDR blocks


• Regular monitoring of network policy performance


• Consider CNI plugin capabilities

Troubleshooting Guide

Common Issues

1. 
   

   Policy Not Applied

   
   
   
   
   
   • Verify CNI plugin supports Network Policies
   
   
   • Check label selectors match intended pods
   
   
   • Confirm policy is in correct namespace
   
   
   
   


2. 
   

   Unexpected Blocking

   
   
   
   
   
   • Review all policies affecting the pod
   
   
   • Check for conflicting rules
   
   
   • Verify namespace labels
   
   
   • Test with temporary allow-all policy
   
   
   
   

Debugging Commands

# List all network policies

kubectl get networkpolicy --all-namespaces



# Describe specific policy

kubectl describe networkpolicy <policy-name> -n <namespace>



# Check pod labels

kubectl get pods --show-labels



# Verify pod connectivity

kubectl exec -it <pod-name> -- wget -qO- http://<service-name>

Advanced Configurations

1. Combining Multiple Rules

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: complex-policy

spec:

  podSelector:

    matchLabels:

      app: web

  policyTypes:

  - Ingress

  - Egress

  ingress:

  - from:

    - namespaceSelector:

        matchLabels:

          environment: prod

    - podSelector:

        matchLabels:

          role: frontend

    ports:

    - protocol: TCP

      port: 80

  egress:

  - to:

    - namespaceSelector:

        matchLabels:

          environment: prod

    ports:

    - protocol: TCP

      port: 5432

2. Using Multiple Port Ranges

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: multi-port-policy

spec:

  podSelector:

    matchLabels:

      app: service

  policyTypes:

  - Ingress

  ingress:

  - ports:

    - protocol: TCP

      port: 80

    - protocol: TCP

      port: 443

    - protocol: UDP

      port: 53

Monitoring and Compliance

Tools and Metrics

• Network Policy Advisor


• Calico Network Policy Logs


• Prometheus metrics for policy evaluation


• Regular compliance audits

Best Practices for Production

1. Version control all network policies


2. Implement change management process


3. Regular security reviews


4. Automated policy testing


5. Documentation of policy intentions

Conclusion

Network Policies are essential for securing Kubernetes clusters. Proper implementation requires understanding of pod networking, careful planning, and regular maintenance. Start with basic policies and gradually implement more complex rules based on security requirements.