We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Kubernetes Containers
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Kubernetes Containers
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
By default, networking is flat. Every pod can communicate with every other pod in the cluster, regardless of namespace. Your frontend pods can reach your database pods directly. A compromised pod in a development namespace can scan and attack production workloads.
Network Policies are Kubernetes-native firewalls. They let you define which pods can send traffic to which other pods, on which ports, using which protocols. Without them, a single compromised pod gives an attacker access to everything in the cluster.
Network Policies implement the principle of least privilege at the network layer. Your frontend should only reach the API. Your API should only reach the database. Your database should accept connections only from the API. Anything else is blocked.
A NetworkPolicy selects pods via labels and defines ingress (incoming) and/or egress (outgoing) rules.
Default deny all (start here):
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all
spec:
podSelector: {} # Applies to all pods
policyTypes:
- Ingress
- Egress
This blocks all traffic. Then you add specific allow rules.
Allow API to reach database:
spec:
podSelector:
matchLabels:
app: database
ingress:
- from:
- podSelector:
matchLabels:
app: api
ports:
- port: 5432
| Selector Type | Matches |
|---|---|
| podSelector | Pods in the same namespace by label |
| namespaceSelector | All pods in matching namespaces |
| ipBlock | External IP ranges (CIDR) |
Important: NetworkPolicy requires a CNI plugin that supports it. Calico, Cilium, and Weave support it. The default AWS VPC CNI does NOT enforce NetworkPolicies without additional configuration.