Network Policy

ELI5 — The Vibe Check

Network policies in Kubernetes are like firewall rules for pods. By default, every pod can talk to every other pod — which is fine until you realize your frontend pods can directly access the database. Network policies let you say 'only the API pods can talk to the database pod.' It's micro-firewall rules for your microservices.

Real Talk

Kubernetes Network Policies are resources that control traffic flow between pods and/or network endpoints. They use label selectors to define which pods can communicate, supporting ingress and egress rules based on pod labels, namespaces, and IP blocks. They require a CNI plugin that supports NetworkPolicy (Calico, Cilium, Weave Net).

Show Me The Code

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-access
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: api
      ports:
        - port: 5432

When You'll Hear This

"Network policies restrict database access to only the API pods." / "Without network policies, any pod in the cluster can talk to any other pod."