NetworkPolicy Fundamentals

NetworkPolicy Fundamentals An architecture diagram generated by Archify. Pod A · no policy · Without NetworkPolicy Pod A no policy Pod B · no policy · Without NetworkPolicy Pod B no policy Pod C · no policy · Without NetworkPolicy Pod C no policy Pod A · policy applied · With NetworkPolicy Pod A policy applied Pod B · allowed peer · With NetworkPolicy Pod B allowed peer Pod C · no allowed path · With NetworkPolicy Pod C no allowed path open open open allowed blocked blocked Without NetworkPolicy With NetworkPolicy Legend Backend

Without NetworkPolicy

  • • With no policy in place, all pod-to-pod traffic is accepted
  • • Pod A, Pod B and Pod C reach each other freely in both directions

With NetworkPolicy

  • • Namespace-scoped resource matching pods by labels, namespaces and IP blocks
  • • policyTypes Ingress and Egress list what is allowed; everything else is implicitly denied
  • • Only Pod A to Pod B remains open