Default-allow vs default-deny — the cluster network's posture

Every Pod in a fresh cluster can reach every other Pod, in any namespace, and nothing records that it happened. A NetworkPolicy changes that, but only for the Pods its podSelector matches and only in the directions named in policyTypes — a default-deny that lists Ingress alone leaves egress wide open. Policies are additive and never subtract, so isolation comes from a deny existing at all rather than from any ordering between rules.

The default network posture

A Kubernetes cluster’s default network posture is allow-all: every Pod can talk to every other Pod, every Service can be reached from any Pod, and the network is open.

flowchart LR
    A[Pod A] -->|Allow| B[Pod B]
    A -->|Allow| C[Pod C]
    B -->|Allow| C

The default is allow-all because the API server does not enforce network policies at the network layer. The CNI plugin may enforce policies, but the default is allow-all unless a policy is in place.

The NetworkPolicy

A NetworkPolicy is a Kubernetes object that specifies the allowed ingress and egress traffic for a set of Pods. The policy is enforced by the CNI plugin.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

The policy above is a default-deny policy: it selects all Pods in the namespace (podSelector: {}) and denies all ingress and egress traffic.

The default-deny pattern

The default-deny pattern is the canonical production pattern:

flowchart TD
    A[Namespace] --> B[default-deny NetworkPolicy]
    B --> C[Allow ingress from frontend]
    B --> D[Allow egress to database]
    B --> E[Allow egress to DNS]
    B --> F[Allow ingress from monitoring]

The pattern is:

1. Default-deny all ingress and egress.
2. Allow explicit traffic for known services.

The default-deny is the cluster’s network posture.

The diagnostic

The canonical diagnostic:

# Substitute your own values before running:
POLICY=default-deny-all
NS=prod
SOURCE_POD=web-5f9c7d8b6c-2xk9p
TARGET_IP=192.0.2.24
TARGET_PORT=8080

# 1. Check the NetworkPolicy
kubectl get networkpolicy -A

# 2. Describe the policy
kubectl describe networkpolicy "$POLICY" -n "$NS"

# 3. Test the connection from a Pod
kubectl exec -it "$SOURCE_POD" -- curl -v "$TARGET_IP:$TARGET_PORT"

# 4. Check the CNI's enforcement
# (CNI-specific: Calico, Cilium, etc.)
kubectl get felixconfiguration -o yaml -n calico-system

The diagnostic is the NetworkPolicy and the CNI’s enforcement.

Common failures

• Default-allow is the assumption. The cluster operator believes the NetworkPolicy is enforced, but the CNI is not enforcing it.
• Default-deny is too restrictive. The NetworkPolicy blocks legitimate traffic.
• Selector mismatch. The NetworkPolicy’s selector does not match the Pods.
• Egress policy missing. The NetworkPolicy denies ingress but allows egress, or vice versa.

flowchart TD
    A[Network failure] --> B{NetworkPolicy denies?}
    B -->|Yes| C[Selector mismatch]
    B -->|No| D{Pod-level DNS?}
    D -->|No| E[DNS is blocked]
    D -->|Yes| F{Network reachability?}
    F -->|No| G[CNI failure]
    F -->|Yes| H[Application failure]

The remediation

The remediation depends on the cause:

# Substitute your own values before running:
POLICY=default-deny-all
NS=prod

# Option 1: Add a default-deny NetworkPolicy
kubectl apply -f default-deny.yaml

# Option 2: Add an explicit allow rule
kubectl apply -f allow-frontend-to-backend.yaml

# Option 3: Fix the selector
kubectl patch networkpolicy "$POLICY" -n "$NS" -p '{"spec":{"podSelector":{"matchLabels":{"app":"billing"}}}}'

# Option 4: Verify the CNI's enforcement
# (CNI-specific)

The remediation is the network policy.

Production discipline

The default network posture is the cluster’s hypothesis. The discipline is to walk the canonical flow extended with the network policy, identify the failure mode, apply the remediation. The network is the cluster’s connectivity; the remediation is the network policy.

• Default-deny is the production pattern. The default is allow-all; the policy is deny-by-default.
• Explicit allow rules. Every legitimate traffic must be explicitly allowed.
• Verify the CNI’s enforcement. The CNI is the policy enforcement layer.

Quiz