microsegmentation-patterns

Microsegmentation Patterns

Implementation approaches for network, application, and identity-based microsegmentation across on-premises and cloud environments.

Knowledge Base

Segmentation Levels

Microsegmentation operates at multiple layers, each providing different granularity and capabilities:

Layer 3/4 (Network): IP addresses, ports, protocols. The most basic form. Implemented via firewalls, security groups, VLANs, and Kubernetes NetworkPolicy. Limitation: IP addresses are not stable identities in dynamic environments (containers, autoscaling).

Layer 7 (Application): HTTP methods, paths, headers, gRPC services. Implemented via service mesh (Istio, Linkerd), application-aware firewalls, and API gateways. Provides much finer control but requires deeper infrastructure integration.

Identity-based: Cryptographic workload identity (SPIFFE/SPIRE, mTLS certificates). Communication is authorized based on verified identity, not network location. The most robust form -- works across clusters, clouds, and hybrid environments.

Default Deny vs. Default Allow

Default deny (target state): All traffic is blocked unless explicitly allowed. This is the zero trust ideal. In practice, it requires a complete communication matrix before enforcement.

Default allow with logging (starting state): All traffic is allowed but logged. Use this phase to discover communication patterns, build the allowlist, and then transition to default deny.

The transition process:

1. Deploy in logging/audit mode (default allow, log everything)
2. Analyze traffic patterns for 2-4 weeks
3. Build communication matrix from observed traffic
4. Create explicit allow policies for legitimate traffic
5. Switch to default deny with allow policies
6. Monitor for breakage, adjust policies
7. Iterate per segment/namespace/tier

Patterns

Pattern 1: Kubernetes NetworkPolicy (L3/L4)

# Default deny all ingress and egress in a namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # Applies to all pods in namespace
  policyTypes:
    - Ingress
    - Egress

---
# Allow frontend to talk to backend API on port 8080
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

---
# Allow backend API to reach database on port 5432
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-database
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: backend-api
      ports:
        - protocol: TCP
          port: 5432

---
# Allow all pods to reach DNS (required for service discovery)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53