Network Policies - kguardian

What are Network Policies?

Kubernetes Network Policies are firewall rules for your pods. They control:

Ingress: What can connect TO your pod
Egress: What your pod can connect TO

Without Network Policies, all pods can communicate with all other pods (flat network).

Structure of a Network Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: my-app
spec:
  podSelector:          # Which pods this policy applies to
    matchLabels:
      app: my-app
  policyTypes:
    - Ingress
    - Egress
  ingress:              # Allow incoming from...
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - port: 8080
  egress:               # Allow outgoing to...
    - to:
        - podSelector:
            matchLabels:
              app: database

How kguardian Generates Policies

Observes traffic continuously via eBPF (let several minutes of representative traffic accumulate before generating)
Identifies peers by resolving IPs to pods/services
Groups rules by protocol and port
Deduplicates to create minimal policies
Generates YAML ready to apply

Default-Deny Strategy

Best practice: Start with default-deny, then allowlist:

# 1. Deny all traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

# 2. Apply kguardian-generated allowlist policies

Next steps: