CME-209
Kubernetes NetworkPolicy Enforcement
Description
Kubernetes-native network segmentation via NetworkPolicy resources that define pod-level ingress and egress rules. Enforces default-deny network posture and explicit allow rules based on pod selectors, namespace selectors, and IP blocks. Prevents lateral movement within cluster by restricting pod-to-pod communication to explicitly allowed paths. Requires CNI plugin support (Calico, Cilium, Weave, Antrea). Policies are namespace-scoped and stack additively.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | N → A | Network attack vector restricted to adjacent pods/namespaces; default-deny blocks lateral movement |
| Scope (S) | C → U | Scope change prevented; compromised pod cannot reach other namespaces without explicit policy |
CWE Relationships
Verification
Verify NetworkPolicy resources exist and CNI enforces them
$ kubectl get networkpolicy -A
# Expected: NetworkPolicy resources exist for sensitive namespaces
# Expected: NetworkPolicy resources exist for sensitive namespaces
Platform: kubernetes
$ kubectl describe networkpolicy <policy-name> -n <namespace> | grep -E 'policyTypes|Ingress|Egress'
# Expected: policyTypes includes Ingress and/or Egress with rules defined
# Expected: policyTypes includes Ingress and/or Egress with rules defined
Platform: kubernetes
$ kubectl get networkpolicy -n <namespace> -o jsonpath='{.items[?(@.spec.podSelector.matchLabels=={})].metadata.name}'
# Expected: default-deny policy exists (empty podSelector = all pods)
# Expected: default-deny policy exists (empty podSelector = all pods)
Platform: kubernetes
$ kubectl get pods -n kube-system -l 'k8s-app in (calico-node, cilium, weave-net, antrea-agent)' | grep -c Running
# Expected: >0 (CNI plugin running)
# Expected: >0 (CNI plugin running)
Platform: kubernetes
Remediation
kubernetes
Kubernetes default-deny NetworkPolicy with explicit allow rules
kubectl apply -n <namespace> -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
EOF
kubectl apply -n <namespace> -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-app-traffic
spec:
podSelector:
matchLabels:
app: <app-label>
policyTypes:
- Ingress
- Egress
ingress:
- from:
- namespaceSelector:
matchLabels:
name: <allowed-namespace>
ports:
- protocol: TCP
port: <port>
egress:
- to:
- namespaceSelector:
matchLabels:
name: <allowed-namespace>
ports:
- protocol: TCP
port: <port>
EOF