10 Best Practices for Using Kubernetes Network Policies

As more applications are deployed in Kubernetes clusters, ensuring that traffic flows securely and efficiently between them becomes increasingly important. Kubernetes Network Policies are a powerful tool for controlling traffic flow at the IP address or port level, but implementing them effectively requires following best practices.

In this article, we will explore 10 best practices for using Kubernetes Network Policies to enhance the security and reliability of your applications.

1. Use namespaces and labels for granular policy enforcement.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-policy
  namespace: backend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend

In this example, we’re applying a Network Policy to the backend namespace, restricting traffic to pods with the label app: backend. We also allow traffic from pods with the label app: frontend.

2. Use default-deny policies to enforce a secure environment.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

By default, Kubernetes allows all network traffic between pods. Using a default-deny policy can help you create a more secure environment by blocking all traffic unless it is explicitly allowed by a policy.

In this example, we’re creating a Network Policy that denies all ingress and egress traffic by default.

3. Use IP blocks to restrict traffic to specific IP addresses or ranges

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-external-access
spec:
  podSelector:
    matchLabels:
      app: backend
  egress:
  - to:
    - ipBlock:
        cidr: 192.168.0.0/16

In this example, we’re creating a Network Policy that restricts egress traffic from pods with the label app: backend to the IP range 192.168.0.0/16.

4. Use port-based policies to control traffic to specific ports

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-http-access
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80

In this example, we’re creating a Network Policy that allows ingress traffic from pods with the label app: frontend to the pods with the label app: backend on port 80.

5. Use labels to apply multiple policies to the same pods

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy1
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy2
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 443

In this example, we’re creating two Network Policies that allow ingress traffic from pods with the label app: frontend to pods with the label app: backend. One policy allows traffic on port 80, while the other allows traffic on port 443.

6. Use namespaces to create isolation boundaries

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-frontend
  namespace: frontend
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: backend

In this example, we’re creating a Network Policy in the frontend namespace that restricts ingress traffic to pods in the backend namespace.

7. Use Network Policies to enforce compliance requirements

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-sensitve-data-access
spec:
  podSelector:
    matchLabels:
      app: sensitive-data
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: trusted-app
    ports:
    - protocol: TCP
      port: 443

In this example, we’re creating a Network Policy that only allows ingress traffic from pods with the label app: trusted-app to the pods with the label app: sensitive-data on port 443.

8. Use Network Policies to improve application security

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-access
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - ipBlock:
        cidr: 10.10.0.0/24
    ports:
    - protocol: TCP
      port: 80

In this example, we’re creating a Network Policy that only allows ingress traffic from IP addresses within the 10.10.0.0/24 CIDR block to the pods with the label app: backend on port 80.

9. Understand and document the traffic flow.

Before creating network policies, it is essential to understand and document how traffic flows within your cluster. This will help you identify which pods need to communicate with each other and which pods should be isolated.

10. Document your policies.

Document your network policies, including the purpose, rules, and expected behavior. This will help you and other developers understand how traffic flows within your cluster.

Conclusion

In conclusion, Kubernetes Network Policies provide a powerful means of controlling traffic flow at the IP address or port level in your Kubernetes cluster. By following the best practices outlined in this article, you can ensure that your policies are effective, reliable, and enhance the security of your applications.

Remember to regularly review and update your policies as your environment changes to ensure that they remain effective. By doing so, you can help to safeguard your applications and data and provide a more secure and efficient experience for your users. With these best practices in mind, you can confidently deploy and manage your applications in Kubernetes with the added peace of mind that comes from knowing your network traffic is secured.

Resource:
Kubernetes documentation on Network Policies