AKS Network Policy: Locking Down Traffic

By default, all pods in a Kubernetes cluster can talk to each other. This is a security risk. If a frontend pod is compromised, the attacker can scan your database pod. Network Policies act as an internal firewall.

Deny All Ingress

Start by blocking everything.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Allow Frontend to Backend

kind: NetworkPolicy
metadata:
  name: api-allow-frontend
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - podSelector:
        matchLabels:
            app: frontend
    ports:
    - port: 80

Key Takeaways

• You must enable a Network Plugin (Azure CNI or Kubenet) that supports policies (Calico or Azure Policy).
• Policies are namespace-scoped.