Lion Cipher Lab
Default-deny east-west traffic in Kubernetes with NetworkPolicy
- Cloud Security
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Here is the fact that surprises almost everyone the first time they hear it: in a brand-new Kubernetes cluster, every single pod can open a network connection to every single other pod, in every namespace, on every port. Nothing stands between them. The marketing site can reach the payroll database. The forgotten debug container someone left running six months ago can reach the secrets-fetching sidecar, the internal metrics endpoint and, in a cloud cluster, the instance metadata service that hands out credentials. None of that is a misconfiguration — that is the shipped default, and it stays…
What you'll learn
- Kubernetes NetworkPolicy
- east-west (pod-to-pod) network segmentation
- default-deny ingress and egress design
- label and namespace selectors, ipBlock and except
- knowing that NetworkPolicy is enforced by the CNI, and how to prove it is
- diagnosing a dropped packet versus a refused connection
- keeping cluster DNS working under a default-deny egress policy
- reducing blast radius and blocking exfiltration paths from a compromised pod
Steps in this lab
- The vocabulary, from absolute zero
- The default nobody tells you about: everything can reach everything
- The most important fact about NetworkPolicy: it is a contract, not an implementation
- Build a throwaway cluster with kind, with the default CNI off and Calico on
- Deploy three workloads across two namespaces — and prove the cluster is wide open
- Default-deny ingress — and learn why it times out instead of being refused
- Allow back exactly what is needed, one rule at a time
- Egress — the half everyone skips, and the half that stops exfiltration
- Reason about policies like a professional: additive, unordered, and both-ended
- The judgment: when NetworkPolicy is the right control, when it is not, and how to roll it out without taking production down