# ahmetb/kubernetes-network-policy-recipes

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/ahmetb-kubernetes-network-policy-recipes).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

6,140 stars · 1,822 forks · Apache-2.0

## Links

- GitHub: https://github.com/ahmetb/kubernetes-network-policy-recipes
- awesome-repositories: https://awesome-repositories.com/repository/ahmetb-kubernetes-network-policy-recipes.md

## Topics

`kubernetes` `networking` `security`

## Description

This project is a library of declarative configuration patterns and templates for implementing network policies within Kubernetes clusters. It provides a collection of reference guides and ready-to-use snippets designed to establish pod isolation and zero-trust traffic rules.

The project focuses on implementing a default-deny security posture, where all network traffic is blocked until explicitly authorized through a whitelist. It provides specific templates for restricting lateral movement and securing microservice boundaries using label-based selectors and port-specific filtering.

Its capabilities cover comprehensive ingress and egress traffic control, including the ability to block external outbound connections and manage inbound requests from both internal pods and external clients. It also includes patterns for namespace-level isolation to restrict communication between different logical project environments.

## Tags

### DevOps & Infrastructure

- [Kubernetes Network Policy Templates](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-network-policy-templates.md) — Provides a library of ready-to-use declarative templates for managing both inbound and outbound cluster traffic. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes#readme))
- [Cross-Namespace Traffic Isolation](https://awesome-repositories.com/f/devops-infrastructure/cross-namespace-traffic-isolation.md) — Establishes network boundaries at the namespace level to block unauthorized communication between project environments. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes#readme))
- [Label-Based Traffic Filtering](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-traffic-controllers/pod-traffic-mirroring/label-based-pod-routing/label-based-traffic-filtering.md) — Filters network packets by matching metadata labels on pods and namespaces to identify authorized partners.
- [Local Namespace Traffic Isolation](https://awesome-repositories.com/f/devops-infrastructure/local-namespace-traffic-isolation.md) — Blocks incoming traffic from external namespaces while permitting internal communication between pods in the same namespace. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md))
- [Traffic Isolation Patterns](https://awesome-repositories.com/f/devops-infrastructure/microservice-traffic-management/traffic-isolation-patterns.md) — Defines precise network boundaries for inbound and outbound requests between microservices using label selectors.
- [Namespace-Based Traffic Restrictions](https://awesome-repositories.com/f/devops-infrastructure/namespace-based-traffic-restrictions.md) — Restricts access to pods based on labels assigned to the originating namespace. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/06-allow-traffic-from-a-namespace.md))
- [Network Policy Templates](https://awesome-repositories.com/f/devops-infrastructure/network-policy-templates.md) — Provides reference collections of declarative configuration patterns for Kubernetes network policies.
- [Pod and Namespace Label Filtering](https://awesome-repositories.com/f/devops-infrastructure/pod-and-namespace-label-filtering.md) — Uses composite rules requiring both pod and namespace label matches for traffic authorization. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/07-allow-traffic-from-some-pods-in-another-namespace.md))
- [Global Inbound Permissions](https://awesome-repositories.com/f/devops-infrastructure/mesh-traffic-policy-management/global-inbound-permissions.md) — Defines cluster-wide policies that permit traffic to a service from any pod in any namespace. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/05-allow-traffic-from-all-namespaces.md))
- [Service Whitelisting Templates](https://awesome-repositories.com/f/devops-infrastructure/microservice-traffic-management/service-whitelisting-templates.md) — Offers standardized patterns for authorizing communication between specific microservices based on labels.

### Security & Cryptography

- [Kubernetes Network Security Policies](https://awesome-repositories.com/f/security-cryptography/kubernetes-network-security-policies.md) — Provides declarative rules for securing pod-to-pod and pod-to-namespace communication in Kubernetes clusters.
- [Pod Isolation Guides](https://awesome-repositories.com/f/security-cryptography/pod-isolation-guides.md) — Offers practical implementation patterns and configuration templates for isolating container workloads using a zero-trust security model. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes#readme))
- [Pod-Based Inbound Restrictions](https://awesome-repositories.com/f/security-cryptography/application-network-restrictions/pod-based-inbound-restrictions.md) — Limits incoming network connections to specific pods based on label selectors to ensure authorized service communication. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/02-limit-traffic-to-an-application.md))
- [Pod-Based Traffic Whitelists](https://awesome-repositories.com/f/security-cryptography/domain-based-access-controls/domain-whitelists/whitelist-based-proxying/pod-based-traffic-whitelists.md) — Implements pod-based traffic whitelists to permit network communication from specific microservices. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes#readme))
- [Namespace-Wide Default Blocking](https://awesome-repositories.com/f/security-cryptography/inbound-traffic-filtering/namespace-wide-default-blocking.md) — Drops all incoming traffic for every pod within a specific namespace to enforce a secure baseline. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/03-deny-all-non-whitelisted-traffic-in-the-namespace.md))
- [Network Namespace Isolation](https://awesome-repositories.com/f/security-cryptography/multi-tenant-isolation/namespace-based-isolation/network-namespace-isolation.md) — Restricts network traffic between different namespaces to create logical environment boundaries.
- [Zero Trust Networking](https://awesome-repositories.com/f/security-cryptography/zero-trust-networking.md) — Implements a security framework where every internal connection must be explicitly authorized.
- [External Inbound Whitelisting](https://awesome-repositories.com/f/security-cryptography/inbound-traffic-filtering/external-inbound-whitelisting.md) — Permits specific incoming connections from the public internet or load balancers while maintaining a default-deny baseline. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/08-allow-external-traffic.md))
- [Network Access Controls](https://awesome-repositories.com/f/security-cryptography/network-infrastructure-security/web-network-security/network-security/network-routing-access-control/network-access-controls.md) — Configures network access controls to permit or block traffic originating from clients outside the cluster. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/README.md))

### Networking & Communication

- [Namespace Communication Boundaries](https://awesome-repositories.com/f/networking-communication/communication-protocols-architectures/communication-architectures/namespace-communication-boundaries.md) — Provides declarative definitions for establishing security boundaries between namespaces to block unauthorized lateral movement. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/README.md))
- [Default Deny Ingress Policies](https://awesome-repositories.com/f/networking-communication/network-traffic-controllers/egress-controllers/default-deny-egress-policies/default-deny-ingress-policies.md) — Establishes a default-deny posture by blocking all inbound traffic until explicit allow rules are defined. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/01-deny-all-traffic-to-an-application.md))
- [Default-Deny Postures](https://awesome-repositories.com/f/networking-communication/network-traffic-controllers/egress-controllers/default-deny-egress-policies/default-deny-ingress-policies/default-deny-postures.md) — Establishes a baseline that blocks all network traffic by default, requiring explicit whitelist rules.
- [Egress Traffic Firewalls](https://awesome-repositories.com/f/networking-communication/network-traffic-controllers/egress-controllers/egress-traffic-firewalls.md) — Implements egress traffic filtering to prevent unauthorized communication with other pods or external endpoints. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes#readme))
- [External Outbound Blocking](https://awesome-repositories.com/f/networking-communication/network-traffic-controllers/egress-controllers/egress-traffic-firewalls/external-outbound-blocking.md) — Provides patterns to block outbound connections to networks outside the cluster while permitting internal traffic. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/14-deny-external-egress-traffic.md))
- [Default Deny Egress Policies](https://awesome-repositories.com/f/networking-communication/network-traffic-controllers/egress-controllers/default-deny-egress-policies.md) — Implements policies that block all outbound traffic except to explicitly allowed destinations.
- [Traffic Origin Selectors](https://awesome-repositories.com/f/networking-communication/network-traffic-rules/traffic-origin-selectors.md) — Defines rules based on whether traffic originates internally or externally to regulate cluster access. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes#readme))
- [Port-Based Filters](https://awesome-repositories.com/f/networking-communication/traffic-filters/port-based-filters.md) — Limits incoming network connections to defined numerical ports to isolate specific application services.
- [Pod](https://awesome-repositories.com/f/networking-communication/traffic-tunneling/port-restrictions/pod.md) — Limits incoming network traffic to specific ports on pods to isolate individual application services. ([source](https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/09-allow-traffic-only-to-a-port.md))

### Part of an Awesome List

- [Learning and Reference](https://awesome-repositories.com/f/awesome-lists/learning/learning-and-reference.md) — Collection of network policy use cases and examples.