NPRC Deny all non whitelisted traffic to a namespace

Deny all non-whitelisted traffic to a namespace

• This Policy blocks all cross-pod networking other than the ones whitelisted via the other Network Policies you deploy.

• This Policy gives you a default deny all functionality. This way, you can clearly identify which components have dependency on which components and deploy other Network Policies which can be translated to dependency graphs between components.

[tan@kmaster ~]$ cat net_policies/default-deny-all.yaml
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-deny-all
  namespace: default
spec:
  podSelector: {}
  ingress: []

Note:

• namespace: default: deploy this policy to the default namespace.
• podSelector: {} : is empty, this means it will match all the pods. Therefore, the policy will be enforced to ALL the pods in the default namespace.
• ingress: [] : There are no ingress rules specified. This causes incoming traffic to be dropped to the selected(=all) pods.
  • In this case, you can also just omit the ingress field, or leave empty like ingress:

[tan@kmaster ~]$ kubectl apply -f net_policies/default-deny-all.yaml 
networkpolicy.networking.k8s.io/default-deny-all created
[tan@kmaster ~]$ 
[tan@kmaster ~]$ kubectl get netpol -n default
NAME               POD-SELECTOR   AGE
default-deny-all   <none>         17s

---

Cleanup

[tan@kmaster ~]$ kubectl delete netpol default-deny-all -n default
networkpolicy.extensions "default-deny-all" deleted