NetworkPolicy explainer

Policies select pods. Once a pod is selected for a direction, only traffic that some rule allows gets through. Define a source and destination and see the trace.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

Policies and workloads

Opening local draft…

# Synthetic NetworkPolicy example
apiVersion: v1
kind: Namespace
metadata:
  name: shop
  labels: { team: shop }
---
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring
  labels: { team: sre }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: shop
spec:
  podSelector: {}
  policyTypes: ["Ingress", "Egress"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-from-web
  namespace: shop
spec:
  podSelector:
    matchLabels: { app: api }
  ingress:
    - from:
        - podSelector:
            matchLabels: { app: web }
      ports:
        - port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-metrics
  namespace: shop
spec:
  podSelector:
    matchLabels: { app: api }
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: { team: sre }
      ports:
        - port: metrics
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-egress
  namespace: shop
spec:
  podSelector:
    matchLabels: { app: web }
  policyTypes: ["Egress"]
  egress:
    - to:
        - podSelector:
            matchLabels: { app: api }
      ports:
        - port: 8080
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels: { k8s-app: kube-dns }
      ports:
        - port: 53
          protocol: UDP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: shop
spec:
  selector:
    matchLabels: { app: api }
  template:
    metadata:
      labels: { app: api }
    spec:
      containers:
        - name: api
          image: registry.example.com/shop/api:2.3.0
          ports:
            - { name: http, containerPort: 8080 }
            - { name: metrics, containerPort: 9090 }

What each policy isolates

Policy	Selects pods	Directions	Supplied workloads matched
default-deny ns shop	{} (everything)	Ingress + Egress no ingress rules: denies all ingress no egress rules: denies all egress	Deployment/api
api-from-web ns shop	app=api	Ingress	Deployment/api
api-metrics ns shop	app=api	Ingress	Deployment/api
web-egress ns shop	app=web	Egress	none supplied

Workload ports known: api (http:8080, metrics:9090)

Scenario tests

Scenario	Result	Actions
	allowed by supplied policies
	denied
	allowed by supplied policies
	denied

Edit: web → api:8080

NameSourceSource namespaceSource labelsSource IPUsed for ipBlock rules (IPv4)Destination namespaceDestination labelsDestination portsname:port list; empty = unknownPortProtocol

Allowed by supplied policies

Egress from source

Egress: shop/app=web is isolated by default-deny, web-egress. Traffic is allowed if ANY rule in ANY of them allows it (policies are additive). default-deny: no egress rules → allows nothing on its own web-egress rule 1: peer namespace = shop + podSelector app=api: matches port 8080/TCP matches 8080 → allowed by web-egress rule 1

Ingress to destination

Ingress: shop/app=api is isolated by default-deny, api-from-web, api-metrics. Traffic is allowed if ANY rule in ANY of them allows it (policies are additive). default-deny: no ingress rules → allows nothing on its own api-from-web rule 1: peer namespace = shop + podSelector app=web: matches port 8080/TCP matches 8080 → allowed by api-from-web rule 1

Enforcement depends on the cluster network plugin (CNI). Whether it enforces NetworkPolicy — and how it treats ipBlock for in-cluster pod IPs — is unknown here.
Both sides must allow: egress from the source AND ingress to the destination. Reply traffic for allowed connections is implicitly allowed.
Egress isolation also blocks DNS unless a rule allows port 53 to the cluster DNS pods.

The model

NetworkPolicies are additive allow-lists. A pod with no policy selecting it is not isolated. Once any policy selects it for Ingress or Egress, traffic in that direction is allowed only if at least one rule in at least one of those policies matches. A connection needs both egress from the source and ingress to the destination.

Inside a peer, namespaceSelector and podSelector together mean both must match. Listed as separate peers, either one is enough. Named ports resolve against the destination pod’s container ports, so they are unresolved when you have not described those ports.

Questions

Will my cluster enforce this?

Only if your network plugin (CNI) implements NetworkPolicy. That cannot be known from manifests, so every result carries this caveat.

Why is DNS mentioned?

Egress isolation blocks DNS too. Most egress policies need a rule allowing UDP and TCP port 53 to the cluster DNS pods.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.