Hands-on Lab·Certified Kubernetes Administrator
NetworkPolicy Default Deny
Prove that an empty cluster lets everything talk to everything, close it with a four-line policy, then open exactly one path. The failure mode is a timeout rather than a refusal, and knowing that difference is most of the diagnosis.
Services and Networking Guide 61 of 103 Intermediate
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 35 min
NetworkPolicy is an API with no built-in implementation. Without a CNI that enforces it, every policy here is silently ignored.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a namespace that is currently wide open has to be closed. This matters because an empty cluster lets everything reach everything, and the four-line policy that changes that is the one worth knowing by heart.
- proving rather than assuming that everything reaches everything with no policy present
- applying a default-deny policy in four lines
- opening exactly one path back up, and verifying that only that path works
Before you start
- A CNI that enforces NetworkPolicy. Calico here. With a plugin that does not, every policy below is accepted by the API and enforces nothing, which is the worst possible failure because it looks like success.
- The labels and selectors guide. Policies select by label and nothing else.
- The Services and EndpointSlices guides, so you can tell a policy drop apart from a broken Service.
-
The default is that everything can reach everything
-
Default deny, in four lines
-
Allow exactly one path