NetworkPolicy

k8s Firewallk8s-network-policy

Allow list for pod traffic at layer 3 and 4, isolating the pods it selects and enforced by the network plugin.

Provider: k8s
Kind: Firewall
Category: Security
Official docs: https://kubernetes.io/docs/concepts/services-networking/network-policies/
Also known as: netpol

Properties · 3 set by this component

property	type	values	required	kind default	this component
additiveRules · component property	boolean	—	no	true	inherited
defaultAction	enum	allow \| deny	no	—	▸ deny
intrusionPrevention	boolean	—	no	—	inherited
logging	boolean	—	no	—	inherited
managed	boolean	—	no	false	▸ false
pluginEnforcementRequired · component property	boolean	—	no	true	inherited
policyScope · component property	enum	ingress \| egress \| ingress-egress	no	ingress	inherited
ruleCount	integer	—	no	—	inherited
stateful	boolean	—	no	—	▸ true

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "network-policy", component: "k8s-network-policy" }

Other Firewall products · 35

Cloud Firewallalibaba-cloud-firewallalibabacloudfirewall Network ACLalibaba-network-aclalibabacloudfirewall ECS Security Groupalibaba-security-groupalibabacloudfirewall Network ACLaws-network-aclawsfirewall AWS Network Firewallaws-network-firewallawsfirewall Amazon Route 53 Resolver DNS Firewallaws-route53-dns-firewallawsfirewall Security groupaws-security-groupawsfirewall Microsoft Entra Internet Accessazure-entra-internet-accessazurefirewall Azure Firewallazure-firewallazurefirewall Network Security Groupazure-network-security-groupazurefirewall Network security perimeterazure-network-security-perimeterazurefirewall Cloudflare DNS Firewallcloudflare-dns-firewallcloudflarefirewall Cloudflare Gatewaycloudflare-gatewaycloudflarefirewall Cloudflare Network Firewallcloudflare-network-firewallcloudflarefirewall Generic firewallfirewallfirewall Firewall appliancefirewall-appliancefirewall Fortinet FortiGatefortigatefirewall MikroTik RouterOSmikrotik-routerosfirewall nftablesnftablesfirewall OPNsenseopnsensefirewall Palo Alto Networks NGFWpalo-alto-ngfwfirewall pfSensepfsensefirewall Snortsnortfirewall Suricatasuricatafirewall VyOSvyosfirewall DigitalOcean Cloud Firewallsdigitalocean-cloud-firewalldigitaloceanfirewall Cloud IDSgoogle-cloud-idsgcpfirewall Cloud NGFWgoogle-cloud-ngfwgcpfirewall Secure Web Proxygoogle-secure-web-proxygcpfirewall IBM Cloud Hardware Firewallibm-firewallibmfirewall VPC Security Groupibm-security-groupibmfirewall Network Firewalloci-network-firewallocifirewall Network Security Groupoci-network-security-groupocifirewall Security Listoci-security-listocifirewall Security Groupoutscale-security-groupoutscalefirewall

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Kubernetes NetworkPolicy: an allow list for pod-to-pod and pod-to-world traffic at OSI layer 3
3# or 4. Per "Network Policies" pods are non-isolated until a policy selects them and accept traffic
4# from any source; once selected, only connections matching a rule are allowed, reply traffic is
5# implicitly allowed, and policies are additive so evaluation order does not matter. If policyTypes
6# is omitted, Ingress is always set and Egress only when egress rules exist. Enforcement requires a
7# network plugin that supports NetworkPolicy; without one the object has no effect.
8schemaVersion: "1"
9type: "component"
10id: "k8s-network-policy"
11kind: "firewall"
12provider: "k8s"
13docs: "https://kubernetes.io/docs/concepts/services-networking/network-policies/"
14aliases: ["netpol"]
15defaults:
16  managed: false
17  defaultAction: "deny"
18  stateful: true
19properties:
20  policyScope:
21    type: "enum"
22    values: ["ingress", "egress", "ingress-egress"]
23    default: "ingress"
24  pluginEnforcementRequired:
25    type: "boolean"
26    default: true
27  additiveRules:
28    type: "boolean"
29    default: true

The same page as markdown, for an agent: /catalogue/components/k8s-network-policy.md