Network Policies are Kubernetes resources that define how Pods communicate with each other and with external endpoints. They act as a distributed firewall at the Pod level, allowing operators to explicitly permit or deny traffic based on labels, namespaces, and ports. By default, most clusters allow unrestricted Pod-to-Pod communication; these policies introduce controlled isolation.
How It Works
A policy selects a group of Pods using label selectors and defines rules for ingress (incoming) and/or egress (outgoing) traffic. Once a Pod is selected by at least one policy, it becomes isolated for the specified traffic direction. Only traffic explicitly allowed by the rules is permitted; everything else is denied by default.
Rules can reference other Pods, namespaces, or IP blocks. For example, you can allow frontend Pods to connect to backend Pods on TCP port 443, while blocking all other inbound traffic. Policies are additive: multiple policies can apply to the same Pod, and Kubernetes evaluates them collectively to determine allowed connections.
Enforcement depends on the Container Network Interface (CNI) plugin. Solutions such as Calico, Cilium, or Weave implement the filtering logic at the network layer, often using iptables, eBPF, or similar kernel-level mechanisms. Without a compatible CNI, policies are defined but not enforced.
Why It Matters
In multi-tenant clusters or microservices architectures, unrestricted east-west traffic increases the attack surface. Network-level segmentation reduces lateral movement during a breach and enforces least-privilege communication between services.
For platform teams, this improves compliance posture, supports zero-trust architectures, and enables safer workload onboarding. It also clarifies service dependencies by making traffic flows explicit and version-controlled <a href="https://aiopscommunity1-g7ccdfagfmgqhma8.southeastasia-01.azurewebsites.net/glossary/infrastructure-monitoring-as-code/" title="Infrastructure Monitoring as Code">as code.
Key Takeaway
Network Policies bring fine-grained, declarative traffic control to Kubernetes, turning open cluster networking into enforceable, least-privilege isolation.