TOPIC SECURITY
Network Policies in-cluster firewall controls for isolating pod traffic
IN 10 SECONDS
Pod-level firewalls. By default, any application inside a cluster can freely talk to any other. Network policies let you define traffic isolation rules so that only designated components (like your frontend) are allowed to access sensitive databases.
GOTCHA Standard basic network setups accept network policy manifests but ignore them silently. You must run a network engine (like Calico or Cilium) to enforce the firewall rules.
HOW TRAFFIC BLOCKING FLOWS
01 Default state all applications in the cluster communicate on a completely open network.
02 Lockdown policy is applied to isolate database pods, dropping all unlisted incoming calls.
03 Approval rule allows incoming connections only from pods carrying the 'role: backend' label.
04 Network agent compiles this rule into kernel-level blocks (iptables or eBPF) on the host machine.
POKE IT YOURSELF
kubectl get netpol -A — list all active firewalls in the cluster
kubectl describe netpol database-isolation — view ingress/egress firewall rules
Drill this topic →
~70 sec read