CME-206

Network Policy (Kubernetes)

Isolate Network Unquantified evidence Preventive

Description

Kubernetes NetworkPolicy resources that restrict pod-to-pod and pod-to-external communication. Default-deny ingress/egress with explicit allowlists.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Vector (AV)	N → A	Pod only reachable from explicitly allowed sources
Scope (S)	C → U	Compromised pod cannot reach arbitrary cluster services

CWE Relationships

CWE-284 CWE-668

Verification

Check for default-deny NetworkPolicy in namespace

$ kubectl get networkpolicy -n <namespace> -o name | head -5
# Expected: networkpolicy.networking.k8s.io/default-deny

Platform: kubernetes

Remediation

kubernetes default-deny ingress and egress NetworkPolicy with per-service allowlisting


kubectl apply -n <namespace> -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
EOF
kubectl apply -n <namespace> -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
EOF
kubectl apply -n <namespace> -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
EOF
kubectl apply -n <namespace> -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-<app_label>-ingress
spec:
  podSelector:
    matchLabels:
      app: <app_label>
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: <source_label>
    ports:
    - protocol: TCP
      port: <service_port>
EOF

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
kubernetes	kubernetes	`cpe:2.3:a:kubernetes:kubernetes::::::::`	All	applicable
redhat	openshift_container_platform	`cpe:2.3:a:redhat:openshift_container_platform:4:::::::*`	All	applicable
google	google_kubernetes_engine		All	applicable
amazon	elastic_kubernetes_service		All	applicable
microsoft	azure_kubernetes_service		All	applicable