76.4 Project 43: Network policies to isolate namespaces
Friends, NetworkPolicy is the firewall between Pods. Today we deny all ingress in payments, allow only shop/web to pay on port 80, and test allow versus block.
मित्रांनो, NetworkPolicy Pods मध्ये firewall आहे. आज payments deny-all, फक्त shop/web → pay:80, allow vs block test.
दोस्तों, NetworkPolicy Pods के बीच firewall है. आज payments deny-all, सिर्फ shop/web → pay:80, allow vs block test.
What you will build in this project
- Labeled namespaces and Pods.
- deny-all NetworkPolicy.
- allow-shop-to-pay policy.
- wget allow and block tests.
1. Start from a real company story
At PhonePe in Bengaluru, Kabir found a payments Pod accepting traffic from a forgotten staging namespace.
They locked NetworkPolicies the same week. Rough past exposure: about ₹70 lakh in potential fraud window.
Today we practice that lock.
Ravindra Bagale's Tip
Students write allow rules without a deny-all first. Traffic still flows from unlabeled Pods. Deny first. Keep that habit.
Students deny-all शिवाय allow लिहितात. Unlabeled Pods पासून traffic येतो. आधी deny. सवय ठेवा.
Students deny-all के बिना allow लिखते हैं. Unlabeled Pods से traffic आता है. पहले deny. आदत रखिए.
2. Start and prepare
Step 1: Why NetworkPolicy
Why: Pod firewall. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: a1
Type this:
echo 'NetworkPolicy is a firewall for Pod-to-Pod traffic inside the cluster'
You will see:
NetworkPolicy is a firewall for Pod-to-Pod traffic inside the cluster
What it means: What NetworkPolicy is.
Example 2: a2
Type this:
echo 'Default without a policy: all Pods can talk to all Pods'
You will see:
Default without a policy: all Pods can talk to all Pods
What it means: Open by default.
Example 3: a3
Type this:
echo 'A CNI that supports NetworkPolicy is required: Calico Cilium Antrea or similar'
You will see:
A CNI that supports NetworkPolicy is required: Calico Cilium Antrea or similar
What it means: CNI tip.
Step 2: Namespaces Pods
Why: Prep labels. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: kubectl create. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: b1
Type this:
echo 'kubectl create namespace shop; kubectl create namespace payments'
You will see:
kubectl create namespace shop; kubectl create namespace payments
What it means: Two namespaces.
Example 5: b2
Type this:
echo 'kubectl label ns shop name=shop; kubectl label ns payments name=payments'
You will see:
kubectl label ns shop name=shop; kubectl label ns payments name=payments
What it means: Namespace labels for selectors.
Example 6: b3
Type this:
echo 'kubectl run web -n shop --image=nginx:1.27-alpine --labels=app=web --restart=Never'
You will see:
kubectl run web -n shop --image=nginx:1.27-alpine --labels=app=web --restart=Never
What it means: Shop web Pod.
Step 3: Attacker Pod
Why: Traffic sources. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: kubectl run. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: c1
Type this:
echo 'kubectl run pay -n payments --image=nginx:1.27-alpine --labels=app=pay --restart=Never'
You will see:
kubectl run pay -n payments --image=nginx:1.27-alpine --labels=app=pay --restart=Never
What it means: Payments Pod.
Example 8: c2
Type this:
echo 'kubectl run attacker -n shop --image=busybox:1.36 --restart=Never --command -- sleep 3600'
You will see:
kubectl run attacker -n shop --image=busybox:1.36 --restart=Never --command -- sleep 3600
What it means: Attacker Pod in shop.
Example 9: c3
Type this:
echo 'Before policy: kubectl exec -n shop attacker -- wget -qO- http://pay.payments.svc 2>&1 | head || true'
You will see:
Before policy: ... wget ... || true
What it means: Often works until policy.
3. Build the main pieces
Step 4: Deny-all
Why: Close the door. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: printf deny. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: d1
Type this:
mkdir -p /tmp/k8s43 && printf '%s\n' 'apiVersion: networking.k8s.io/v1' 'kind: NetworkPolicy' 'metadata: {name: deny-all-ingress, namespace: payments}' 'spec:' ' podSelector: {}' ' policyTypes: [Ingress]' > /tmp/k8s43/deny.yaml && cat /tmp/k8s43/deny.yaml
You will see:
kind: NetworkPolicy
...
What it means: Deny all ingress in payments.
Example 11: d2
Type this:
echo 'kubectl apply -f /tmp/k8s43/deny.yaml'
You will see:
kubectl apply -f /tmp/k8s43/deny.yaml
What it means: Apply deny-all.
Example 12: d3
Type this:
echo 'Empty podSelector {} selects all Pods in the namespace'
You will see:
Empty podSelector {} selects all Pods in the namespace
What it means: Selector tip.
Step 5: Allow shop to pay
Why: Open least path. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: printf allow. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: e1
Type this:
printf '%s\n' 'apiVersion: networking.k8s.io/v1' 'kind: NetworkPolicy' 'metadata: {name: allow-shop-to-pay, namespace: payments}' 'spec:' ' podSelector: {matchLabels: {app: pay}}' ' policyTypes: [Ingress]' ' ingress:' ' - from:' ' - namespaceSelector: {matchLabels: {name: shop}}' ' podSelector: {matchLabels: {app: web}}' ' ports: [{protocol: TCP, port: 80}]' > /tmp/k8s43/allow.yaml && grep -A8 'ingress:' /tmp/k8s43/allow.yaml
You will see:
ingress:
- from:
What it means: Allow only shop/web to pay:80.
Example 14: e2
Type this:
echo 'kubectl apply -f /tmp/k8s43/allow.yaml'
You will see:
kubectl apply -f /tmp/k8s43/allow.yaml
What it means: Apply allow policy.
Example 15: e3
Type this:
echo 'Policies in a namespace are additive for allowed traffic'
You will see:
Policies in a namespace are additive for allowed traffic
What it means: Additive tip.
Step 6: Test wget
Why: Prove. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: wget tests. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: f1
Type this:
echo 'kubectl exec -n shop web -- wget -qO- --timeout=2 http://pay.payments 2>&1 | head || echo blocked-or-ok'
You will see:
kubectl exec -n shop web -- wget ...
What it means: web should be allowed when CNI enforces.
Example 17: f2
Type this:
echo 'kubectl exec -n shop attacker -- wget -qO- --timeout=2 http://pay.payments 2>&1 | head || echo blocked'
You will see:
kubectl exec -n shop attacker -- wget ... || echo blocked
What it means: attacker should be blocked.
Example 18: f3
Type this:
echo 'If both succeed, your CNI may not enforce NetworkPolicy — switch to Calico for the lab'
You will see:
If both succeed, your CNI may not enforce NetworkPolicy — switch to Calico for the lab
What it means: CNI failure mode.
4. Automate and verify
Step 7: DNS egress
Why: Name resolution. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: printf dns. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: g1
Type this:
printf '%s\n' 'apiVersion: networking.k8s.io/v1' 'kind: NetworkPolicy' 'metadata: {name: allow-dns, namespace: payments}' 'spec:' ' podSelector: {}' ' policyTypes: [Egress]' ' egress:' ' - to:' ' - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}' ' podSelector: {matchLabels: {k8s-app: kube-dns}}' ' ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]' > /tmp/k8s43/dns.yaml && head -8 /tmp/k8s43/dns.yaml
You will see:
kind: NetworkPolicy
What it means: Allow DNS egress when you lock egress.
Example 20: g2
Type this:
echo 'Egress lock without DNS breaks name resolution'
You will see:
Egress lock without DNS breaks name resolution
What it means: Common footgun.
Example 21: g3
Type this:
echo 'kubectl apply -f /tmp/k8s43/dns.yaml'
You will see:
kubectl apply -f /tmp/k8s43/dns.yaml
What it means: Apply DNS allow.
Step 8: List describe
Why: Inspect. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: get describe. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: h1
Type this:
echo 'kubectl get networkpolicy -n payments'
You will see:
kubectl get networkpolicy -n payments
What it means: List policies.
Example 23: h2
Type this:
echo 'kubectl describe networkpolicy allow-shop-to-pay -n payments'
You will see:
kubectl describe networkpolicy allow-shop-to-pay -n payments
What it means: Describe allow.
Example 24: h3
Type this:
echo 'Label mistakes are the top reason policies do nothing'
You will see:
Label mistakes are the top reason policies do nothing
What it means: Debug tip.
Step 9: Safe order
Why: Habits. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo order. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: i1
Type this:
echo 'Default-deny ingress then open least paths: that is the safe order'
You will see:
Default-deny ingress then open least paths: that is the safe order
What it means: Order habit.
Example 26: i2
Type this:
echo 'ipBlock CIDR rules can allow office bastion ranges'
You will see:
ipBlock CIDR rules can allow office bastion ranges
What it means: ipBlock tip.
Example 27: i3
Type this:
echo 'Never leave payments open to every namespace'
You will see:
Never leave payments open to every namespace
What it means: Payments habit.
5. Harden and accept
Step 10: CI and Hubble
Why: Observe. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo CI. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: j1
Type this:
echo 'Test from a Job that curls the target and exits non-zero on block'
You will see:
Test from a Job that curls the target and exits non-zero on block
What it means: CI tip.
Example 29: j2
Type this:
echo 'Document expected allow and deny pairs in your notebook'
You will see:
Document expected allow and deny pairs in your notebook
What it means: Docs habit.
Example 30: j3
Type this:
echo 'Cilium Hubble can show drops when you use Cilium CNI'
You will see:
Cilium Hubble can show drops when you use Cilium CNI
What it means: Observability tip.
Step 11: Cleanup
Why: Cleanup. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: cleanup. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: k1
Type this:
echo 'Optional cleanup: kubectl delete ns shop payments'
You will see:
Optional cleanup: kubectl delete ns shop payments
What it means: Cleanup.
Example 32: k2
Type this:
echo 'Save deny-all and allow-shop-to-pay YAML'
You will see:
Save deny-all and allow-shop-to-pay YAML
What it means: Artifact.
Example 33: k3
Type this:
echo 'Next project adds ResourceQuotas per team'
You will see:
Next project adds ResourceQuotas per team
What it means: Bridge.
Step 12: Acceptance
Why: Kabir signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: z1
Type this:
echo 'deny-all then allow-shop-to-pay applied'
You will see:
deny-all then allow-shop-to-pay applied
What it means: Checklist policies.
Example 35: z2
Type this:
echo 'attacker wget expected blocked when CNI enforces'
You will see:
attacker wget expected blocked when CNI enforces
What it means: Checklist test.
Example 36: z3
Type this:
echo 'Kabir: PASS'
You will see:
Kabir: PASS
What it means: Project 43 accepted.
Check yourself
Q1. Who locked PhonePe?
Kabir
Q2. Open by default?
yes
Q3. Empty podSelector means?
all Pods
Q4. Allow source ns label?
name=shop
Q5. Port allowed?
80
Q6. CNI examples?
Calico Cilium Antrea
Friends, you isolated payments with NetworkPolicy. Did you understand? Let us try it once more. Add egress locks carefully with DNS allow next.
मित्रांनो, तुम्ही payments NetworkPolicy ने isolate केले. Egress + DNS allow जोडा.
दोस्तों, आपने payments NetworkPolicy से isolate किया. Egress + DNS allow जोड़ें.
Lab: try at home
- Create labeled namespaces and Pods.
- Apply deny-all ingress.
- Apply allow from shop/web.
- Test allow and block.
- Optional DNS egress.
Recap
- CNI must support policies.
- Deny first then allow.
- Labels must match.
- Additive allows.
- Document allow/deny pairs.