Last Updated: November 21, 2025
Focus Areas
| Focus |
|---|
Use namespace and pod selectors to scope rules
|
Define both ingress and egress because defaults are permissive
|
Commands & Queries
kubectl apply -f deny-all.yaml
Lock down networking
kubectl apply -f allow-api.yaml
Allow API server traffic
kubectl get netpol -n my-namespace
Audit active policy coverage
Summary
Keep pods isolated by default, log denied flows, and document your policy reasoning.
💡 Pro Tip:
Start with deny-all policies and add selectors incrementally.