---
title: "Deny pod traffic by default with network · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/kubernetes-network-policies
id: INF-81
level: Required
applies: servers
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1068
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Deny pod traffic by default with network policies

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-81
- Level: Required
- Chapter: [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)
- Rule: Start every namespace with a policy that denies all incoming and outgoing pod traffic. Then allow each path the service needs, by label and port.
- Check: Every namespace that runs workloads has a default deny policy for ingress and egress. A test pod in the web namespace fails to connect to the database port of another namespace, and the web pods succeed.
- Risk: An account or system taken over
- Applies when: The project runs its own servers, virtual machines or containers.
- How: By default every pod can reach every other pod in the cluster, so one taken-over pod can reach every database. A `NetworkPolicy` that selects all pods and allows nothing closes that. Add one policy per path, such as from the ingress to the web pods on port 8080. Add another from the web pods to the database on 5432. Allow DNS to the cluster's DNS service, or nothing resolves. Policies work only when the cluster's network plugin enforces them, such as Calico or Cilium, so test that first. Single hosts follow [Put each container only on the networks it needs](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/container-networks.md). Cloud networks follow [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny, namespace: shop }
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: web-to-db, namespace: shop }
spec:
  podSelector: { matchLabels: { app: postgres } }
  ingress:
    - from: [{ podSelector: { matchLabels: { app: shop-web } } }]
      ports: [{ port: 5432 }]
```

### Shell example

```sh
# Expect a timeout from the proxy pod and a connection from the web pod
kubectl -n shop exec deploy/proxy -- nc -z -w 3 postgres 5432
kubectl -n shop exec deploy/shop-web -- nc -z -w 3 postgres 5432
```

## Sources

- [Kubernetes, Network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [NIST SP 800-190 Application Container Security Guide](https://csrc.nist.gov/pubs/sp/800/190/final)

## Related rules

- INF-77 [Put each container only on the networks it needs](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/container-networks.md) in Infrastructure and environments
- INF-30 [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/kubernetes-network-policies">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep enough copies running through planned disruptions](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/pod-disruption-budgets.md)
- Next: [Enforce the restricted pod security standard](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/pod-security-standards.md)
- [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)