Implementing Default Deny All Network Policies

In this lesson, you will learn how to transition from a flat, insecure network to a zero-trust model by applying a baseline "Deny All" policy to your Kubernetes cluster.

The "Default Deny" Philosophy

By default, Kubernetes follows a "flat" networking model where any pod can communicate with any other pod across the cluster. While convenient for initial development, this is a security liability. Implementing a "Default Deny" policy changes the security posture from "allow everything" to "deny everything by default," requiring you to explicitly whitelist only the traffic you intend to permit.

Implementing the Policy

To establish this baseline, we apply a NetworkPolicy resource to a specific namespace. When no other rules exist, this effectively silences all communication for pods within that namespace.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {} # Selects all pods in the namespace
  policyTypes:
  - Ingress
  - Egress

Why this is a Zero Trust Baseline

1. Ingress Isolation: By including Ingress in policyTypes with an empty podSelector, you prevent unauthorized pods or external services from reaching your application pods.
2. Egress Isolation: By including Egress in policyTypes, you prevent pods from "calling home" to malicious external servers or scanning other internal services, which is a critical defense against data exfiltration.
3. The Allow-list Approach: Once this policy is active, your applications will be unable to communicate. You must then layer on additional, specific NetworkPolicy resources to selectively permit required traffic (e.g., allowing a frontend service to talk to a backend API).

This approach ensures that every connection in your cluster is intentional and documented. By starting with a "Deny All" baseline, you ensure that any new pod deployed into the cluster is secure by default, rather than vulnerable by default.

Key Takeaway: Applying a "Default Deny All" NetworkPolicy creates a secure baseline by forcing an intentional, allow-list-only model for all ingress and egress traffic in your cluster.