Restricting Traffic with NetworkPolicies

A NetworkPolicy (networking.k8s.io/v1) describes allowed traffic to and from Pods matched by a podSelector. But Kubernetes itself does not enforce it — that's the job of the cluster's CNI network plugin. If the CNI in use doesn't implement NetworkPolicy, every NetworkPolicy object in the cluster is accepted and stored, but silently has no effect at all; traffic keeps flowing as if none existed.

The other default worth knowing: a Pod that no NetworkPolicy selects at all is fully open — Kubernetes' baseline is allow-all, not deny-all, until some policy specifically targets that Pod.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes: ["Ingress"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-frontend
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: frontend

policyTypes (Ingress, Egress, or both) decides which directions a policy actually restricts for the Pods it selects. Once any NetworkPolicy selects a Pod for a given direction, that direction becomes default-deny for that Pod — only traffic matching an allow rule in some applicable policy gets through. Multiple policies selecting the same Pod are additive: the union of everything they each allow, never a stricter intersection. An ingress[].from entry can match by podSelector, by namespaceSelector to allow an entire namespace, or by ipBlock for a CIDR range outside the cluster; egress rules use the same building blocks in the outbound direction, including reaching external IPs.