Hands-on Lab·Kubernetes and Cloud Native Associate
NetworkPolicy Scope and Limitations
Two Pods talk in plaintext, a default-deny stops them dead, and one label-based rule lets exactly one caller back in. Then kubectl explain shows the ceiling: addresses and ports, no identity and no HTTP - which is the whole reason meshes exist.
Networking and Discovery Guide 18 of 46 Intermediate
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 18 min
NetworkPolicy enforcement needs a CNI plugin that implements it. Calico does; some plugins accept the object and enforce nothing.
- Service meshnone installed
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when you have to justify why a NetworkPolicy is not sufficient on its own. This matters because policies select by label and port, so they can say which Pods may talk to each other but nothing about identity, encryption, or what is inside the request.
- confirming that with no policy in place every Pod reaches every other Pod, in plaintext
- applying the smallest useful default-deny policy and watching traffic stop dead
- letting exactly one caller back in with a label-based ingress rule
- reading
kubectl explain networkpolicy.spec.ingress.fromto see the ceiling - peers and ports, not identity or content
Before you start
- A CNI plugin that enforces NetworkPolicy. Calico, Cilium and Antrea do; check yours before concluding a policy does not work.
- The Services and DNS guides from the fundamentals track.
-
By default, everything can reach everything
-
Default-deny, and the shape of the object
-
Let exactly one caller back in
-
The ceiling, in two explain outputs