🔒

Kubernetes NetworkPolicy: Pod-Level Firewall

Medium

Free preview · 2 of 5 steps

NetworkPolicy: pod-level microsegmentation in Kubernetes

By default, every pod in a Kubernetes cluster can communicate with every other pod — regardless of namespace, workload type, or sensitivity. A compromised frontend pod can directly query the database. A rogue pod in any namespace can reach production services.

NetworkPolicy is Kubernetes's built-in mechanism for pod-level microsegmentation: it defines which pods can send and receive traffic, filtered by pod labels, namespace labels, and port numbers. It's the Kubernetes equivalent of a firewall rule — but applied per-pod rather than per-subnet.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step