Network Segmentation and Policy

Network Segmentation (Practical)

• Default-deny + explicit allow is ideal, but rollout must be staged.
• Start with protecting crown-jewel dependencies (DB, secrets, control plane).
• Control egress: most incidents and exfiltration use outbound paths.

Staged Rollout Plan

1. Observe traffic (flow logs) and build an allowlist.
2. Apply policy to canary namespace or one workload.
3. Monitor: failed connections, retries, latency.
4. Expand gradually; keep break-glass label/namespace.

NetworkPolicy Example (Allow Only)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-to-db
  namespace: app
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes: ["Egress"]
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: db
    ports:
    - protocol: TCP
      port: 5432

Failure Modes

• DNS blocked: everything breaks (ensure kube-dns is allowed).
• Hidden dependencies: policies reveal unknown calls; treat as signal, not nuisance.