NetworkPolicy Patterns

Services and Networking / Guide 62 of 103 / Advanced

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 40 min

The kube-dns pod label k8s-app: kube-dns is what the DNS allowance matches. Verify it on your cluster before copying.

• CoreDNSv1.14.2

This guide includes

Use this when a policy has closed more than you intended - which usually means DNS. This matters because restricting egress breaks name resolution before it breaks anything you were actually thinking about, and the fix turns on understanding AND versus OR inside a rule.

• allowing a whole namespace with namespaceSelector, and seeing policies add up rather than override
• restricting egress and watching the Pod lose DNS while still reaching a bare IP
• adding the DNS allowance, and seeing where a rule means AND and where it means OR
• verifying all the policies together at the end, which is the step people skip

Before you start

• The default-deny guide. This one continues from its Pods and policies.
• The CoreDNS guide, because the central lesson here is what happens when a Pod loses DNS.
• A CNI that enforces NetworkPolicy.

1. 1

   Allow a whole namespace, and see policies add up

2. 2

   Restrict egress, and break the Pod in an unexpected way

3. 3

   The DNS allowance, and AND versus OR

4. 4

   Everything back on, verified together

Official sources

• Network Policies
• Allow DNS egress
• NetworkPolicy API reference
• Automatic namespace labels
• Calico network policy