I'm setting up a new Kubernetes cluster and want to improve its network security with Cilium. Each application runs in its own namespace, and FluxCD manages the deployments. Should I create policies for every individual pod and traffic flow, or is it better to start with namespace-level policies and a few necessary port restrictions? Also, should system namespaces be locked down as well? I'd appreciate practical advice on finding a balance between strong isolation and keeping the policy setup manageable.
1 Answer
A good baseline is to default-deny traffic and then explicitly allow only the flows each application needs. Start at the namespace or application level rather than writing a separate policy for every pod immediately. Use stable labels and service identities so the policies continue to work as pods are replaced, and add rules for required DNS, ingress, egress, and monitoring traffic. Build this incrementally and observe existing traffic first so you don’t end up maintaining a huge collection of unnecessary rules.
That makes sense. I’d prefer to begin with broader namespace-level rules and tighten them for specific applications once I understand the actual traffic patterns.