Why this matters
A default-deny baseline limits lateral movement and unintended traffic.
If a PR introduces workloads in a namespace that lacks a default-deny NetworkPolicy, add one plus explicit allow rules.
A default-deny baseline limits lateral movement and unintended traffic.
Side-by-side examples engineers can pattern-match during review.
files:
- k8s/namespaces/payments.yaml
- k8s/deployments/payments-api.yaml
# (no NetworkPolicy)files:
- k8s/namespaces/payments.yaml
- k8s/deployments/payments-api.yaml
- k8s/networkpolicies/payments-default-deny.yaml
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: payments
spec:
podSelector: {}
policyTypes: ["Ingress", "Egress"]
kind: NetworkPolicy
metadata:
name: default-deny
namespace: paymentskind: Deployment
metadata:
name: payments-api
namespace: paymentsFrom the same buckets as this rule.