ahmetb/kubernetes-network-policy-recipes

Features

• Kubernetes Network Policy Templates - Provides a library of ready-to-use declarative templates for managing both inbound and outbound cluster traffic.
• Kubernetes Network Security Policies - Provides declarative rules for securing pod-to-pod and pod-to-namespace communication in Kubernetes clusters.
• Pod Isolation Guides - Offers practical implementation patterns and configuration templates for isolating container workloads using a zero-trust security model.
• Cross-Namespace Traffic Isolation - Establishes network boundaries at the namespace level to block unauthorized communication between project environments.
• Label-Based Traffic Filtering - Filters network packets by matching metadata labels on pods and namespaces to identify authorized partners.
• Local Namespace Traffic Isolation - Blocks incoming traffic from external namespaces while permitting internal communication between pods in the same namespace.
• Traffic Isolation Patterns - Defines precise network boundaries for inbound and outbound requests between microservices using label selectors.
• Namespace-Based Traffic Restrictions - Restricts access to pods based on labels assigned to the originating namespace.
• Network Policy Templates - Provides reference collections of declarative configuration patterns for Kubernetes network policies.
• Pod and Namespace Label Filtering - Uses composite rules requiring both pod and namespace label matches for traffic authorization.
• Namespace Communication Boundaries - Provides declarative definitions for establishing security boundaries between namespaces to block unauthorized lateral movement.
• Default Deny Ingress Policies - Establishes a default-deny posture by blocking all inbound traffic until explicit allow rules are defined.
• Default-Deny Postures - Establishes a baseline that blocks all network traffic by default, requiring explicit whitelist rules.
• Egress Traffic Firewalls - Implements egress traffic filtering to prevent unauthorized communication with other pods or external endpoints.
• External Outbound Blocking - Provides patterns to block outbound connections to networks outside the cluster while permitting internal traffic.
• Pod-Based Inbound Restrictions - Limits incoming network connections to specific pods based on label selectors to ensure authorized service communication.
• Pod-Based Traffic Whitelists - Implements pod-based traffic whitelists to permit network communication from specific microservices.
• Namespace-Wide Default Blocking - Drops all incoming traffic for every pod within a specific namespace to enforce a secure baseline.
• Network Namespace Isolation - Restricts network traffic between different namespaces to create logical environment boundaries.
• Zero Trust Networking - Implements a security framework where every internal connection must be explicitly authorized.
• Global Inbound Permissions - Defines cluster-wide policies that permit traffic to a service from any pod in any namespace.
• Service Whitelisting Templates - Offers standardized patterns for authorizing communication between specific microservices based on labels.
• Default Deny Egress Policies - Implements policies that block all outbound traffic except to explicitly allowed destinations.
• Traffic Origin Selectors - Defines rules based on whether traffic originates internally or externally to regulate cluster access.
• Port-Based Filters - Limits incoming network connections to defined numerical ports to isolate specific application services.
• Pod - Limits incoming network traffic to specific ports on pods to isolate individual application services.
• External Inbound Whitelisting - Permits specific incoming connections from the public internet or load balancers while maintaining a default-deny baseline.
• Network Access Controls - Configures network access controls to permit or block traffic originating from clients outside the cluster.
• Learning and Reference - Collection of network policy use cases and examples.

Star history