Cloud › Module 7 › Lesson 2
Network Policies
Network policy literacy — default deny, pod selector, ingress/egress rules — on kind YOUR cluster lab namespace.
Visual · t31_network_policies
Network policies = named segmentation rows. kind YOUR cluster. Original Cyberlium.
Opening
Flat pod networks let lateral movement spread — name NetworkPolicy fields on YOUR kind lab before assuming prod mesh will save you.
Network policy literacy names: default-deny stub category, podSelector and namespaceSelector, ingress rule (from pods/labels category), egress rule (to DNS/kube-api category literacy), and policy ordering note. Analyst drafts NetworkPolicy manifest for `$CLOUD_LAB` kind YOUR cluster lab namespace — documents intended allow paths for one frontend/backend lab pair — without testing policies by attacking stranger pods, without disabling CNI on shared clusters, without prod network policy apply without RoE. Cyberlium teaches segmentation vocabulary — defender micro-segmentation literacy — NOT lateral movement between unauthorized namespaces. Refused: unauthorized prod policy apply, policy bypass attack repro, stranger cluster pod scanning. Lab row: NetworkPolicy YAML stub with default-deny plus two allow rules annotated.
1. Named policy fields
podSelector, policyTypes, ingress, egress, namespaceSelector — five literacy anchors.
Default-deny baseline then explicit allow — document order on lab manifest.
Command guide
Try these commands — Named policy fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NetworkPolicy — https://kubernetes.io/docs/concepts/services-networking/network-policies/ K8s network plugins — https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/ CNI security — https://kubernetes.io/docs/concepts/cluster-administration/networking/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/k8s/networkpolicy-stub.yaml" <<'EOF'
# NetworkPolicy stub — default deny egress except DNS — YOUR cluster
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-egress
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- protocol: UDP
port: 53
EOFCommand — copy this
grep -E 'NetworkPolicy|default-deny|egress' "$CLOUD_LAB/k8s/networkpolicy-stub.yaml" curl -sS https://kubernetes.io/docs/concepts/services-networking/network-policies/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: NetworkPolicy (https://kubernetes.io/docs/concepts/services-networking/network-policies/); K8s network plugins (https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/); CNI security (https://kubernetes.io/docs/concepts/cluster-administration/networking/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab namespace pair
Frontend/backend lab pair on kind — label selectors match YOUR deploy names.
DNS egress allow row documented — common literacy gap.
3. Refused
No unauthorized prod policy apply; no lateral movement validation on stranger pods.
Network policy literacy supports segmentation — not offensive pivot testing.
4. What you ship: NetworkPolicy manifest stub
Default-deny + two allow rules + annotation + NEVER stranger pod attack line.
5. What you record before the next lesson
NetworkPolicy manifest stub path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pivot between stranger Kubernetes namespaces to 'test if policy works.'
Right
NetworkPolicy stub for kind YOUR cluster lab namespace. Next: Secrets Hygiene.
Mission: NetworkPolicy manifest stub
1) Name five NetworkPolicy fields. 2) Default-deny baseline. 3) Two explicit allow rules. 4) Write NEVER stranger pod pivot line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “DNS egress — minimum allow literacy?”
Knowledge Check
APPLY: Network policy literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Lateral movement between stranger pods is lab.
True or False
Knowledge Check
APPLY: Default-deny means:
Multiple choice