Kubernetes:NetworkPolicies
lastmod 2025-12-22created 2025-12-221 edits
If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), network policies let you define rules for traffic flow within the cluster as well as between pods and the outside world. The cluster must use a network plugin that supports network policies.
If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), you might consider using Kubernetes NetworkPolicies for particular applications in your cluster. A NetworkPolicy is an application-centric construct that lets you specify how a pod is allowed to communicate with various network "entities" on the network (the word "entity" is used here to avoid overloading more common terms such as "endpoint" and "service", which have special meanings in Kubernetes). NetworkPolicies apply only to connections with a pod on one or both ends, and are not relevant to other connections.
The entities that a pod can communicate with are identified through a combination of the following 3 identifiers.
- Other pods that are allowed (exception: a pod cannot block access to itself)
- Namespaces that are allowed
- IP blocks (exception: traffic to and from the node where a pod is running is always allowed, regardless of the IP address of the pod or the node)
When defining a pod- or namespace-based NetworkPolicy, you use a selector to specify the traffic to and from the pods that match the selector.
Meanwhile, when an IP-based NetworkPolicy is created, the policy is defined based on IP blocks (CIDR ranges).