Network Policy

Original Prepium workshop · Tested on Kubernetes v1.35.8 on 8 September 2026; NetworkPolicy checks used Calico v3.32.2. Use a disposable cluster with a NetworkPolicy-enforcing CNI, such as Calico. A policy object can be accepted even when the installed network plugin does not enforce it.

Allow frontend traffic and prove that other traffic is denied

All three Pods below live in prepium-tutorial. The destination has label app=backend. The permitted source has app=frontend; the denied source has app=visitor. We test TCP port 80 directly against the backend Pod IP to keep DNS and Service routing out of the diagnosis.

frontend (app=frontend) ── TCP/80 allowed ──→ backend (app=backend)
visitor  (app=visitor)  ── TCP/80 denied  ──→ backend (app=backend)
namespace: prepium-tutorial

1. Establish a working baseline

kubectl create namespace prepium-tutorial
kubectl -n prepium-tutorial run backend --image=nginx:1.27-alpine --labels=app=backend
kubectl -n prepium-tutorial run frontend --image=busybox:1.36 --labels=app=frontend --command -- sleep 3600
kubectl -n prepium-tutorial run visitor --image=busybox:1.36 --labels=app=visitor --command -- sleep 3600
kubectl -n prepium-tutorial wait --for=condition=Ready pod --all --timeout=120s
BACKEND_IP=$(kubectl -n prepium-tutorial get pod backend -o jsonpath='{.status.podIP}')
kubectl -n prepium-tutorial exec frontend -- wget -T 3 -qO- "http://$BACKEND_IP"
kubectl -n prepium-tutorial exec visitor -- wget -T 3 -qO- "http://$BACKEND_IP"

Both requests must succeed before applying the policy. If the visitor was already blocked, its later timeout cannot prove this policy works. Diagnose the server, routing and other policies first.

2. Select the destination, then the allowed source

Save this as network-policy.yaml and apply it. The top-level podSelector chooses the protected backend Pods. The nested selector chooses which source Pods can connect.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-from-frontend
  namespace: prepium-tutorial
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 80

kubectl apply -f network-policy.yaml
kubectl -n prepium-tutorial describe networkpolicy backend-from-frontend
kubectl -n prepium-tutorial exec frontend -- wget -T 3 -qO- "http://$BACKEND_IP"
kubectl -n prepium-tutorial exec visitor -- wget -T 3 -qO- "http://$BACKEND_IP"

The frontend should still receive the nginx page. The visitor should fail, commonly with a timeout and a nonzero exit status. Allow the CNI a short reconciliation interval and repeat with new requests. This policy limits ingress to selected Pods; it does not create an egress restriction.

3. Catch selector mistakes

The nested podSelector here matches source Pods in the policy's namespace. To allow only matching Pods in another namespace, put namespaceSelector and podSelector in the same from list entry. Putting them in separate entries broadens access because either entry may match.

Other policies are additive. If the visitor still succeeds, inspect all policies selecting the backend and confirm that enforcement is enabled. An additional allow-all policy can permit traffic that this policy does not explicitly allow.

Variation: create another namespace with a Pod labelled app=frontend. Predict whether this policy allows it before testing. Do not widen the namespace selector until you can explain which sources it would add.

Cleanup: kubectl delete namespace prepium-tutorial. Reference: Kubernetes NetworkPolicy semantics. Next, try Pod-label troubleshooting or namespace isolation.