Kubernetes default-deny NetworkPolicy: a safe rollout checklist

A default-deny policy is the base of network isolation in Kubernetes. Applied carelessly, it also cuts your workloads off from DNS and each other. Use this list to roll it out one namespace at a time.

Updated 2026-10-17 · Venture Lab 10

The policy

This is the free sample from the DevOps Template Store. It selects every pod in one namespace and isolates them for both ingress and egress:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: demo-only
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

Kubernetes documents that by default a pod is non-isolated, so all connections are allowed. A policy like this one makes the selected pods isolated. Only the traffic that another policy explicitly allows can then flow.

Before you apply it

• Your network plugin must enforce NetworkPolicy. Kubernetes warns that creating a NetworkPolicy without a controller that implements it has no effect. Check that your CNI supports NetworkPolicy.
• Start in a test namespace. Change namespace on purpose. The sample uses demo-only so it cannot hit a real namespace by accident.
• Know your pod labels. Allow policies select pods by label. Check them with kubectl get pods --show-labels.
• List the traffic each workload needs. Include ingress from the ingress controller or other services, egress to databases and external APIs, and egress to the cluster DNS service.

Apply in order

• Allow DNS egress first, to your cluster DNS pods on port 53 (UDP and TCP). Without it, almost everything fails with name-resolution errors.
• Add allow policies for each required flow, one at a time.
• Apply default-deny last, then test every flow you listed.
• Watch application errors and readiness for a while before you move on to the next namespace.

Keep it maintainable

• Store the policies with the application manifests, so new services ship with their allow rules.
• Review the policies when you add a dependency.
• Document the rollback: deleting the default-deny policy restores the previous behaviour.

The free DevOps templates include this policy, the Terraform validation workflow and an incident triage runbook. They are starter examples, provided as-is, so review them for your cluster.

Venture Lab 10 is independent. Other product and service names are used only to describe compatibility or for comparison, and are trademarks of their owners.

← All guides