--- title: How to Use Kubernetes Network Policies to Control Pod... description: Kubernetes NetworkPolicies control which pods can talk to each other using labels, namespaces, and ports. The guide builds a three-namespace setup (frontend,... canonical: https://daily.dev/posts/u8gahkvtg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Use Kubernetes Network Policies to Control Pod Communication | daily.dev og:description: Kubernetes NetworkPolicies control which pods can talk to each other using labels, namespaces, and ports. The guide builds a three-namespace setup (frontend,... og:url: https://daily.dev/posts/u8gahkvtg og:image: https://api.daily.dev/og/posts/u8GAhKvtG.png og:image:alt: Post cover image og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Use Kubernetes Network Policies to Control Pod Communication **[NetDevOps](https://daily.dev/sources/netdevops)** · [@cjbaccus](https://daily.dev/cjbaccus) · 14 upvotes · 3 comments ## Summary Kubernetes NetworkPolicies control which pods can talk to each other using labels, namespaces, and ports. The guide builds a three-namespace setup (frontend, backend, database) and restricts traffic so only frontend pods reach the backend on port 8080, and only backend pods reach the database on port 5432. It shows a default-deny ingress policy and a separate egress policy, noting that policies are additive and that ingress and egress isolation must be configured separately. It warns that a NetworkPolicy only works if the cluster's network plugin enforces it, and that default-deny rules can break DNS or health checks if allow rules are missing. Verification commands like 'kubectl get networkpolicy -A' and 'kubectl describe networkpolicy' are included to check that rules are applied correctly. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@divyesh\_vekariya** · 1 upvotes > Great point! NetworkPolicies need to be tested against actual traffic flow, not just YAML rules. CNI behavior, source NAT, DNS, and health checks can all affect whether the intended security boundaries work as expected. **@sinarezaei** · 1 upvotes > One thing worth testing beyond the YAML examples is what happens when traffic goes through a Kubernetes Service. > > For example, imagine an application behind a LoadBalancer Service where `externalTrafficPolicy` is set to `Cluster`. Depending on the traffic path and networking implementation, source NAT can change the source IP before the packet reaches the destination Pod. > > That can make an `ipBlock` rule behave differently from what you'd expect when writing the policy. You might allow a specific client CIDR, only to discover that the destination Pod sees a node IP instead of the original... ## Similar posts on daily.dev - [Kubernetes Networking Explained Without the Hand-Waving](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) · Medium · 5 upvotes · 1 comments - [What Is Kubernetes Networking?](https://daily.dev/posts/what-is-kubernetes-networking--1qghzles9) · Isovalent · 16 upvotes · 0 comments - [Troubleshooting Cilium network policies: Four common pitfalls](https://daily.dev/posts/troubleshooting-cilium-network-policies-four-common-pitfalls-iufrjib8y) · Datadog · 1 upvotes · 0 comments - [From intent to enforcement: Lessons from operating Kubernetes controllers at scale](https://daily.dev/posts/from-intent-to-enforcement-lessons-from-operating-kubernetes-controllers-at-scale-8zbhu5ita) · The New Stack · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/u8gahkvtg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/u8gahkvtg","headline":"How to Use Kubernetes Network Policies to Control Pod Communication","text":"Shared: How to Use Kubernetes Network Policies to Control Pod Communication","url":"https://daily.dev/posts/u8gahkvtg","datePublished":"2026-10-28T18:40:30.714Z","dateModified":"2026-10-28T18:40:30.719Z","author":{"@type":"Person","name":"Carl Baccus","url":"https://daily.dev/cjbaccus","image":"https://avatars.githubusercontent.com/u/1283307?v=4","description":"DevSecOps Engineer specializing in NetDevOps.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":3560}},"image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":14},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/YGiS6QgdI"},"comment":[{"@type":"Comment","text":"Great point! NetworkPolicies need to be tested against actual traffic flow, not just YAML rules. CNI behavior, source NAT, DNS, and health checks can all affect whether the intended security boundaries work as expected.","datePublished":"2026-11-02T03:17:02.899Z","url":"https://daily.dev/posts/u8GAhKvtG#c-0XvNSllN3","author":{"@type":"Person","name":"Divyesh Vekariya","url":"https://daily.dev/divyesh_vekariya","image":"https://media.daily.dev/image/upload/s--RDCl1xsD--/f_auto/v1728905544/avatars/avatar_WXcnVdXbQljWuHJCBcViw"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"One thing worth testing beyond the YAML examples is what happens when traffic goes through a Kubernetes Service.\nFor example, imagine an application behind a LoadBalancer Service where externalTrafficPolicy is set to Cluster. Depending on the traffic path and networking implementation, source NAT can change the source IP before the packet reaches the destination Pod.\nThat can make an ipBlock rule behave differently from what you’d expect when writing the policy. You might allow a specific client CIDR, only to discover that the destination Pod sees a node IP instead of the original client IP.\nI’d test this with both externalTrafficPolicy: Cluster and Local, inspect the actual packet source at the destination, and verify the behavior with the cluster’s specific CNI implementation.\nThe important part is that a NetworkPolicy isn’t just a YAML configuration exercise. The real security boundary depends on how packets actually move through the cluster.","datePublished":"2026-10-31T12:06:30.871Z","url":"https://daily.dev/posts/u8GAhKvtG#c-lZgkZSawr","author":{"@type":"Person","name":"Sina Rezaei","url":"https://daily.dev/sinarezaei","image":"https://lh3.googleusercontent.com/a/ACg8ocLXjJ5mCeyMCQK6CSjPfPxZisLuVwj3KOgnAtXoJoPAAsuvSrxh=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/netdevops","name":"NetDevOps"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NetDevOps","item":"https://daily.dev/squads/netdevops"},{"@type":"ListItem","position":3,"name":"How to Use Kubernetes Network Policies to Control Pod Communication"}]} ```