Q25: Kubernetes Network Policies & Microsegmentation: Default deny-all security postures and multi-tier isolation. - DevOps & Kubernetes (50 Qs)

Network Security & Zero Trust Microsegmentation

By default, the Kubernetes network is completely open: any Pod can establish a TCP connection with any other Pod in any namespace. NetworkPolicies enforce Layer 3/4 firewall rules using label selectors, evaluated by the CNI plugin (e.g., Calico or Cilium).

scss

[ Frontend Pod ] -------- Allowed (Port 5432) ---------> [ Backend Pod ]
       |                                                        |
       X Blocked                                                | Allowed (Port 5432)
       v                                                        v
[ Rogue / Comp. Pod ]                                    [ Database Pod ]

1. The Production "Default Deny All" Baseline

Always apply a default deny-all ingress policy in every production namespace to establish a zero-trust perimeter:

yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {} # Applies to all pods in the namespace
  policyTypes:
    - Ingress

2. Principle of Least Privilege: Allow Specific DB Traffic

yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-db
  namespace: production
spec:
  podSelector:
    matchLabels:
      role: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: backend-api
      ports:
        - protocol: TCP
          port: 5432

Any other pod attempting to reach port 5432 on database pods has its TCP SYN packets silently dropped at the kernel layer.