Network Policies

Network policy literacy — default deny, pod selector, ingress/egress rules — on kind YOUR cluster lab namespace.

Network Policies• Audio Walkthrough

00:00/03:07

Visual · t31_network_policies

Network policies = named segmentation rows. kind YOUR cluster. Original Cyberlium.

Flat pod networks let lateral movement spread — name NetworkPolicy fields on YOUR kind lab before assuming prod mesh will save you.

Network policy literacy names: default-deny stub category, podSelector and namespaceSelector, ingress rule (from pods/labels category), egress rule (to DNS/kube-api category literacy), and policy ordering note. Analyst drafts NetworkPolicy manifest for `$CLOUD_LAB` kind YOUR cluster lab namespace — documents intended allow paths for one frontend/backend lab pair — without testing policies by attacking stranger pods, without disabling CNI on shared clusters, without prod network policy apply without RoE. Cyberlium teaches segmentation vocabulary — defender micro-segmentation literacy — NOT lateral movement between unauthorized namespaces. Refused: unauthorized prod policy apply, policy bypass attack repro, stranger cluster pod scanning. Lab row: NetworkPolicy YAML stub with default-deny plus two allow rules annotated.

1. Named policy fields

podSelector, policyTypes, ingress, egress, namespaceSelector — five literacy anchors.

Default-deny baseline then explicit allow — document order on lab manifest.

Command guide

Try these commands — Named policy fields

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, curl. Reference sites: NetworkPolicy (https://kubernetes.io/docs/concepts/services-networking/network-policies/); K8s network plugins (https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/); CNI security (https://kubernetes.io/docs/concepts/cluster-administration/networking/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Lab namespace pair

Frontend/backend lab pair on kind — label selectors match YOUR deploy names.

DNS egress allow row documented — common literacy gap.

3. Refused

No unauthorized prod policy apply; no lateral movement validation on stranger pods.

Network policy literacy supports segmentation — not offensive pivot testing.

4. What you ship: NetworkPolicy manifest stub

Default-deny + two allow rules + annotation + NEVER stranger pod attack line.

5. What you record before the next lesson

NetworkPolicy manifest stub path.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Pivot between stranger Kubernetes namespaces to 'test if policy works.'
Right: NetworkPolicy stub for kind YOUR cluster lab namespace. Next: Secrets Hygiene.

Hands-on Exercise