Amazon EKS — Network Policies

1 minute read

Network Policies

By default, all pods in a Kubernetes cluster can communicate with all other pods. Network policies let you control which pods can talk to which pods.

Default Behavior

Without Network Policies (default):
┌────────────────────────────────────┐
│  Every pod can talk to every pod   │
│                                    │
│  PodA ←──→ PodB ←──→ PodC        │
│    ↕          ↕          ↕        │
│  PodD ←──→ PodE ←──→ PodF        │
│                                    │
│  No restrictions!                  │
└────────────────────────────────────┘

Enable Network Policies on EKS

EKS doesn’t enforce network policies by default. You need a network policy engine:

Option Type Recommendation
Amazon VPC CNI Network Policy Native Recommended (built-in since VPC CNI v1.14)
Calico Add-on Mature, feature-rich

Enable VPC CNI network policy:

$ aws eks update-addon \
    --cluster-name demo \
    --addon-name vpc-cni \
    --configuration-values '{"enableNetworkPolicy": "true"}'

Basic Network Policy Examples

Deny All Ingress (Default Deny)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}      # Applies to ALL pods in namespace
  policyTypes:
    - Ingress
  # No ingress rules = deny all incoming

Allow Specific Traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend         # Target: backend pods
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend  # Allow: only from frontend
      ports:
        - port: 8080
          protocol: TCP

Common Patterns

Example: 3-Tier Application
┌───────────────────────────────────────────────────────┐
│                                                       │
│  Internet → [frontend]                                │
│              Allow: from internet (Ingress)            │
│                                                       │
│  [frontend] → [backend]                               │
│              Allow: from frontend pods only            │
│                                                       │
│  [backend] → [database]                               │
│              Allow: from backend pods, port 5432 only  │
│                                                       │
│  [database] → nothing outbound                        │
│              Deny: all egress (except DNS)             │
│                                                       │
└───────────────────────────────────────────────────────┘

Common Mistakes

Mistake Impact
Creating NetworkPolicy without a policy engine Policies are silently ignored
Forgetting to allow DNS (port 53) in egress Pods can’t resolve service names
Applying deny-all without allow rules Breaks everything
Not testing policies in staging first Production outage

What’s Next?

Advanced networking: Custom Networking.

You may also enjoy