Loading...
Generate Kubernetes NetworkPolicy YAML — default-deny, allow from pod/namespace/CIDR, egress with DNS — from a simple form.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: web-allow-api
namespace: default
spec:
podSelector:
matchLabels:
app: "web"
policyTypes: [Ingress, Egress]
ingress:
- from:
- podSelector:
matchLabels:
app: "api"
ports:
- port: 8080
protocol: TCP
egress:
# Allow DNS to kube-dns so name resolution still works under egress lock-down
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
NetworkPolicies are additive and namespace-scoped, and need a CNI that enforces them (Calico, Cilium…). An empty rule list means deny all for that direction — validate with the YAML Validator.