cni-network-policies

name	cni-network-policies
description	Container Network Interface (CNI) plugin patterns and Kubernetes NetworkPolicy for agent network isolation. CNI plugin structure, IPAM, namespace-level firewall rules, egress restrictions, and deny-all defaults. Sources: containernetworking/plugins (Apache-2.0).

/cni-network-policies

When to Use

• Isolate agent namespaces: agent-A cannot reach agent-B's pods directly
• Deny-all default with explicit allow: principle of least-privilege networking
• Restrict egress: sandboxed agents can only call approved external endpoints
• Block inter-namespace traffic: dev agents cannot reach prod database pods

Do NOT use for

• L7 policy (use [[istio-traffic-management]] for HTTP-level AuthorizationPolicy)
• Performance-sensitive East-West (NetworkPolicy adds iptables rules, minor overhead)

---

NetworkPolicy: deny all ingress/egress by default

# Apply first in every namespace — blocks all traffic until explicitly allowed
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name:      deny-all
  namespace: yamtam
spec:
  podSelector: {}       # applies to all pods in namespace
  policyTypes:
    - Ingress
    - Egress
  # No ingress/egress rules = deny everything