World map

 

BM

World K3: Counters & Doors

NetworkPolicies and CNI plugins

You will learn: to lock pod doors by default, and let in only the pods you choose.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

You are here: cluster kind-dev namespace default

A stranger tray walks straight into the shop kitchen. By default, every door in the cluster is open.

Watch

A NetworkPolicy: A guest list on a pod's door: which pods may come in, chosen by label. is a guest list on a pod’s door. Nobody on the list? The door stays shut. Turn on the lock, then send an order.

Break one hop so the user gets: a timeout.

  1. BrowserGET / on port 80
  2. Gateway (entrance)entrance listens on :80
  3. HTTPRoute (signboard)/ → shop:80
  4. Service (order number)shop: port 80 → 80
  5. EndpointSlice (ready trays)2 ready of 2
  6. Pod (tray)shop-94c9756fd-8tghh listens on :80
Break something

Predict

You apply this policy. Can the client still reach the shop?

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Try it

Every door is locked now. Let only the client back in with allow-client.yaml.

You are here: cluster kind-dev namespace default
  • shop3/3 ready
dev-control-planeOpenManager

No trays here.

dev-workerOpen
  • shop·6n92s
  • shop·pfz6p
  • stranger
dev-worker2Open
  • client
  • shop·c24gr
Time: +0s (sped up)

Its guest list:

  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: client
      ports:
        - port: 80

Check

This lock won’t apply. Read kubectl’s words, then fix it.

Fix the manifest, then press Apply.

deny-all.yaml9 lines

Plain words: Kubernetes knows Ingress and Egress, with capitals only.

Watch

A policy is only words. The CNI plugin: The food court's walkways: the network plugin that gives pods IPs and enforces NetworkPolicies. plugin, the food court’s walkways, makes them real. Which plugins do that?

Drag a card into a box. Or tap the card, then tap the box.

      Check

      Judge each habit.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      Start a namespace with deny-all, then allow by label.

      You did it!

      You can now lock pod doors, and let in only the right pods.

      Go deeper (optional)

      Where the story breaks: a Service is not a real counter. Nobody stands there; each stall just rewrites addresses. A locked door makes no sound: dropped packets vanish, so you see a timeout. Policies add up: any matching allow rule opens the door. Egress rules can block DNS too.

      Real rep (optional), on kind 0.24 or newer:

      Real mission

      4. kubectl get networkpolicy

      0 of 4 steps done · Your ticks are saved.