Network Policies

Default Open, Then Lock Down

By default every pod can reach every other pod — the flat network model with no firewall. NetworkPolicy objects flip that for selected pods: once a pod is selected by any policy, traffic not explicitly allowed is dropped (for the directions covered by policyTypes).

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-allow }
spec:
  podSelector: { matchLabels: { app: api } }
  policyTypes: [Ingress]
  ingress:
  - from:
    - podSelector: { matchLabels: { app: web } }
    ports:
    - { protocol: TCP, port: 8080 }

The example allows only web pods to reach api on 8080. Everything else touching api's ingress is denied — including other namespaces unless you add namespaceSelector.

Selectors and Directions

Policy combinations pack the real meaning:

• podSelector alone — pods in the policy's own namespace.
• namespaceSelector — pods in matched namespaces (any node).
• namespaceSelector + podSelector in one peer — pods matching both.
• ipBlock — CIDR ranges, for external destinations or exceptions.

policyTypes must include Egress before egress rules apply — listing only Ingress leaves outbound traffic untouched:

policyTypes: [Ingress, Egress]
egress:
- to:
  - namespaceSelector: { matchLabels: { env: prod } }

Empty ingress: [] with the pod selected means deny all ingress. DNS needs an explicit egress rule to port 53 or resolution breaks cluster-wide.

Pitfalls and Interview Angles

Pitfall 1 — assuming policies apply without a supporting CNI. Enforcement requires a plugin that implements them (Calico, Cilium, and most modern CNIs do; basic Flannel does not). Objects apply cleanly and silently do nothing.

Pitfall 2 — breaking DNS or health checks. Locking egress without allowing UDP/TCP 53 to kube-system makes pods fail in confusing ways; allowing health probes from the node (ipBlock or namespace selectors matching kubelet source) avoids false positives.

Interview-ready: state "selected = restricted; unselected = unrestricted," describe default-deny as a baseline posture (select everything, empty rules), and give your verification test — run a client pod and wget the target before and after applying the policy.