AKS Network Policy: Locking Down Traffic

By default, K8s is flat. Any pod can talk to any pod. In a multi-tenant cluster, this is a security violation.

Deny All Strategy

We implement a “Zero Trust” network policy.

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Then we explicitly allow traffic:

spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend