Namespaces and NetworkPolicy

Namespaces and NetworkPolicy An architecture diagram generated by Archify. Internet · External traffic · Architecture component Internet External traffic Frontend Pods · frontend-1 · frontend-2 · default namespace Frontend Pods frontend-1 · frontend-2 API Pods · api-1 · api-2 · default namespace API Pods api-1 · api-2 Database Pods · db-1 · db-2 · default namespace · role=db Database Pods db-1 · db-2 role=db NetworkPolicy · db-network-policy · default namespace NetworkPolicy db-network-policy Prometheus · Metrics collection · monitoring namespace Prometheus Metrics collection external requests API calls DB queries applies to role=db pods metrics scrape default namespace monitoring namespace Legend Frontend App pod DB pod NetPolicy Internet

Default behavior

  • • By default, all pods can communicate with each other
  • • A NetworkPolicy lets you selectively restrict that traffic

What it controls

  • • Communication between pods and between namespaces
  • • Ingress (incoming) and egress (outgoing) traffic
  • • Port- and protocol-based filtering

Example policy db-network-policy

  • • Applies to podSelector role=db pods in the default namespace
  • • Ingress: only TCP 3306 from role=frontend pods · Egress: only TCP 9090 to role=monitoring pods