Network policies for traffic control in Kubernetes - Step-by-Step Execution

Process Flow - Network policies for traffic control

Define NetworkPolicy YAML

↓

Apply NetworkPolicy to Namespace

↓

Kubernetes enforces rules

↓

Pods allowed or denied traffic

↓

Traffic flows controlled as per policy

This flow shows how a network policy is defined, applied, and enforced to control pod traffic in Kubernetes.

Execution Sample

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend

This NetworkPolicy allows ingress traffic to pods labeled 'app: nginx' only from pods labeled 'role: frontend'.

Process Table

Step	Action	Target Pods	Traffic Source	Result
1	Define NetworkPolicy YAML	Pods with label app=nginx	Pods with label role=frontend	Policy created but not applied yet
2	Apply NetworkPolicy to Namespace	Pods with label app=nginx	Pods with label role=frontend	Policy active, Kubernetes starts enforcing
3	Traffic attempt from pod with role=frontend	Pods with label app=nginx	Pod role=frontend	Allowed: matches ingress rule
4	Traffic attempt from pod without role=frontend	Pods with label app=nginx	Pod without role=frontend	Denied: no matching ingress rule
5	Traffic attempt to pod without app=nginx label	Pods without app=nginx	Any pod	Allowed: policy does not select these pods
6	No other policies present	Pods with app=nginx	Other pods	Denied: default deny all except allowed
7	End	-	-	Traffic controlled as per policy rules

💡 Execution stops after all traffic attempts are evaluated against the policy rules.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
NetworkPolicy Active	False	True	True	True	True
Traffic Allowed to app=nginx from role=frontend	N/A	N/A	Yes	Yes	Yes
Traffic Allowed to app=nginx from other pods	N/A	N/A	N/A	No	No

Key Moments - 3 Insights

Why is traffic from pods without the 'role=frontend' label denied to 'app=nginx' pods?

Because the NetworkPolicy ingress rule only allows traffic from pods labeled 'role=frontend' (see execution_table step 4). Traffic from other pods does not match the rule and is denied.

Why do pods without the 'app=nginx' label not get affected by this NetworkPolicy?

The policy selects pods with label 'app=nginx' only (execution_table step 5). Pods without this label are not selected, so the policy does not apply to them and their traffic is not restricted.

What happens if no NetworkPolicy is applied in a namespace?

By default, all traffic is allowed. Applying a NetworkPolicy restricts traffic to only what is explicitly allowed (execution_table step 6 shows default deny behavior after policy applied).

Visual Quiz - 3 Questions

Look at the execution table, at which step does Kubernetes start enforcing the NetworkPolicy?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Check the 'Action' and 'Result' columns in execution_table rows for when policy becomes active.

According to the variable tracker, what is the value of 'Traffic Allowed to app=nginx from other pods' after step 4?

A Yes

B No

C N/A

D Unknown

💡 Hint

Look at the 'After Step 4' column for that variable in variable_tracker.

If we add another ingress rule allowing traffic from pods labeled 'role=backend', what would change in the execution table?

A Traffic from 'role=backend' pods would be allowed in step 4

B Traffic from 'role=frontend' pods would be denied

C Pods without 'app=nginx' label would be denied traffic

D No change in traffic rules

💡 Hint

Consider how ingress rules affect traffic sources in execution_table step 4.

Concept Snapshot

NetworkPolicy controls pod traffic in Kubernetes.
Define YAML with podSelector and ingress/egress rules.
Apply policy to namespace to enforce rules.
Only traffic matching rules is allowed; others denied.
Pods not selected by policy are unaffected.
Default deny applies when policy exists.

Full Transcript

Network policies in Kubernetes let you control which pods can talk to each other. You write a YAML file that selects pods by labels and defines rules for allowed traffic. When you apply this policy to a namespace, Kubernetes enforces it. Traffic from pods matching the allowed labels can reach the selected pods. Traffic from others is blocked. Pods not selected by the policy are not affected. Without any policy, all traffic is allowed. This visual trace shows defining, applying, and enforcing a policy that allows only pods labeled 'role=frontend' to access pods labeled 'app=nginx'. Traffic from other pods is denied. This helps secure communication inside your cluster.