Network Policies

Learn Kubernetes NetworkPolicies for controlling Pod-to-Pod and Pod-to-external traffic in supported CNI environments.

Last reviewed: June 2026

·Kubernetes 1.28+kubectl 1.28+Helm 3+Managed Kubernetes: EKS, AKS, GKE
✅
Quick Understanding: NetworkPolicies define which Pods can talk to which other Pods or network ranges. They require a CNI plugin that enforces them.

🔍 What Is It?

A NetworkPolicy is a Kubernetes object for network-level traffic control.

It can restrict ingress and egress for selected Pods based on Pod selectors, namespace selectors, IP blocks, ports, and protocols.

🎯 Why Do We Need It?

By default, many clusters allow broad Pod-to-Pod communication. Production platforms need network segmentation to reduce blast radius and support compliance.

Common developer mistakes:

  • →Treating Kubernetes YAML as copy-paste configuration instead of production architecture
  • →Ignoring requests, limits, health probes, security context, and rollout behavior
  • →Debugging only the Pod while forgetting Services, DNS, NetworkPolicies, nodes, and admission controls
  • →Manually changing live objects without updating Git or infrastructure automation

🏗️ What Happens in Real Projects?

A payments namespace allows traffic to payment-api only from checkout Pods and allows egress only to the database Service and approved external payment endpoints. Everything else is denied by default.

⚙️ How It Works

NetworkPolicies select Pods and define allowed ingress or egress. Once a Pod is selected by a policy for a direction, only explicitly allowed traffic is permitted for that direction.

The CNI plugin must implement policy enforcement.

💻 Example

Allow traffic from one app — A policy allowing checkout Pods to call payment Pods.

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-checkout-to-payments
  namespace: payments
spec:
  podSelector:
    matchLabels:
      app: payment-api
  policyTypes: [Ingress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: checkout
          podSelector:
            matchLabels:
              app: checkout-api
      ports:
        - protocol: TCP
          port: 8080

🤔 Common Confusions

❓ Do NetworkPolicies work in every cluster?

No. The CNI plugin must support and enforce NetworkPolicy.

❓ Are NetworkPolicies firewalls for Services?

They apply to selected Pods, not Services directly.

❓ Does creating one policy block all traffic?

Only selected Pods become restricted for the policy direction. A default-deny policy is usually created separately.

🚨 Common Production Issues

**CNI does not enforce policy** gives false confidence.

**No default deny** leaves broad east-west traffic open.

**DNS accidentally blocked** breaks service discovery.

**Policies not tested** cause production connectivity outages.

✅ Best Practices

Verify CNI NetworkPolicy support

Start with namespace-level default deny in controlled rollouts

Explicitly allow DNS where needed

Model app dependencies before enforcing

Test policies in staging and use observability for denied traffic

🏛️ Architect's Note

Senior Architect's Perspective

NetworkPolicies are microsegmentation for Kubernetes. They are most effective when combined with namespace ownership and clear service dependency maps.

💬 Frequently Asked Questions

Interview: How would you explain Network Policies in a real Kubernetes project?

Network Policies should be explained through the workload it supports, the Kubernetes object relationships, the failure modes, the security controls, and how it is observed and rolled back in production.

Interview: What production mistake do developers commonly make with Network Policies?

The common mistake is making the object work once, then skipping ownership, resource sizing, rollout safety, monitoring, least privilege, and recovery behavior.

🎯 Key Takeaways

1NetworkPolicies restrict Pod traffic
2CNI support is required
3Default deny must be intentional
4DNS and dependency mapping are common pitfalls

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these Kubernetes references to verify the concept in official docs and continue into the most relevant SplashRide pages.