| name | network-security |
| description | Configure Kubernetes network security including host access restrictions, network policies, port management, and connectivity requirements. Use when writing, reviewing, or auditing pod specs, Services, NetworkPolicies, or NetworkAttachmentDefinitions.
|
| category | secure_development |
| subcategory | kubernetes |
Network Security
Restrict host access, enforce network policies, declare all ports, and ensure connectivity across default and secondary networks.
Host Access Restrictions
Workload pods must not access host resources. All of the following must be disabled:
Required for: all profiles (mandatory)
| Field | Required Value |
|---|
spec.hostIPC | false |
spec.hostNetwork | false (or not set) |
spec.hostPID | false |
spec.volumes[].hostPath | Not used |
spec.containers[].ports[].hostPort | Not used |
spec:
hostIPC: false
hostNetwork: false
hostPID: false
containers:
- name: app
ports:
- containerPort: 8080
Why: Host IPC exposes inter-process communication, host network removes network isolation, host PID exposes all host processes, host path mounts expose the host filesystem, and host ports create port conflicts and bypass network controls.
Network Policies
Workload namespaces should have a default deny-all NetworkPolicy for both ingress and egress traffic. After applying the default deny, add specific policies to allow only required traffic flows.
Required for: all profiles (optional, recommended best practice)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: app-ns
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
Then allow specific traffic:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-app-ingress
namespace: app-ns
spec:
podSelector:
matchLabels:
app: app
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend-ns
ports:
- port: 8080
protocol: TCP
Port Management
Declare All Container Ports
All ports a container listens on must be declared in the container spec. Platforms may block undeclared ports.
Required for: Extended (mandatory), all others (optional)
containers:
- name: app
ports:
- containerPort: 8080
name: http
- containerPort: 9090
name: metrics
Reserved Ports
Containers must not listen on ports reserved by OpenShift: 22623 and 22624. These are used by the Machine Config Server.
Required for: all profiles (mandatory)
Containers must also not use ports reserved by partners.
Required for: Extended (mandatory), all others (optional)
No NodePort Services
Services must use ClusterIP (default) or LoadBalancer — not NodePort. See the pod-access-control skill for details.
Dual-Stack Services
Services should be configured as IPv6 single-stack or dual-stack (IPv4/IPv6). Avoid IPv4-only service configurations to support modern network architectures.
Required for: Extended (mandatory), all others (optional)
apiVersion: v1
kind: Service
metadata:
name: app-svc
spec:
ipFamilyPolicy: PreferDualStack
ipFamilies:
- IPv6
- IPv4
selector:
app: app
ports:
- port: 8080
Connectivity
Workload containers must be able to communicate via ICMPv4 and ICMPv6 on the default OpenShift network. If using Multus secondary networks, connectivity must also work on those networks.
Required for (default network): Telco/Far-Edge/Extended (mandatory), Non-Telco (mandatory for ICMPv4, optional for ICMPv6)
Required for (Multus networks): Telco/Far-Edge/Extended (mandatory), Non-Telco (optional)
To exclude a pod from connectivity tests, add the label redhat-best-practices-for-k8s.com/skip_connectivity_tests.
SR-IOV Configuration
NetworkAttachmentDefinition MTU
SR-IOV NetworkAttachmentDefinitions must have an explicit MTU value set to prevent packet fragmentation and performance issues.
Required for: all profiles (mandatory)
Restart-on-Reboot Label
Pods using SR-IOV network interfaces must have the restart-on-reboot label to ensure recovery from node reboots.
Required for: Extended/Far-Edge (mandatory), Telco (optional), Non-Telco (optional)
Implementation Checklist
Certsuite Test Mapping
References
