Network Policies Overview

Network Policies let you control which pods can talk to each other inside the cluster. They become important once your applications stop being a single service and start behaving like a real distributed system with frontends, APIs, databases, and background workers.

Use this section to understand the security model before reading the raw YAML files.

What you should learn here

• A policy is an allow-list, not a firewall that blocks everything by default unless a policy selects the pod.
• Policies are usually written around pod labels, namespaces, and ports.
• A default-deny policy is the usual starting point when you want tighter isolation.
• After that, you add explicit allow rules for the traffic that should remain open.

Files in this section

• default-deny-policy.yaml blocks unwanted traffic to selected pods until you allow it explicitly.
• allow-frontend-to-backend.yaml shows a targeted rule that re-opens only the frontend-to-backend path.

Suggested order

1. Read this overview.
2. Apply the default deny policy and inspect what breaks.
3. Apply the allow rule and verify the intended traffic works again.
4. Adjust labels and ports to match your own application layout.

Practical note

Network Policies only work when your Kubernetes networking plugin supports them. If a policy appears to have no effect, verify your cluster's CNI implementation first.