Kubernetes NetworkPolicy Generator

By default, in a Kubernetes cluster every pod talks to every pod. There is no isolation between namespaces or between applications — the database accepts connections from the reporting service, from the frontend and from anything compromised that happens to be running there. NetworkPolicy is the resource that closes that, and its model contains an inversion that catches people out.

Enter the name and the label of who may come in, and the page assembles the manifest. The inversion is this: while no policy selects a pod, it accepts everything; as soon as the first policy selects it, it starts refusing everything not explicitly allowed. In other words, creating a restrictive policy is not what closes the door — what closes it is a policy coming to exist that points at that pod.

Two things regularly surprise people. The first is that the policy only works if the cluster network plugin implements it: with some simpler plugins the manifest is accepted and ignored, which gives a false sense of isolation. The second is that rules are additive — several policies selecting the same pod add up their permissions and never restrict one another.