network-security

Network Security

Restrict host access, enforce network policies, declare all ports, and ensure connectivity across default and secondary networks.

Host Access Restrictions

Workload pods must not access host resources. All of the following must be disabled:

Required for: all profiles (mandatory)

Field	Required Value
spec.hostIPC	false
spec.hostNetwork	false (or not set)
spec.hostPID	false
spec.volumes[].hostPath	Not used
spec.containers[].ports[].hostPort	Not used

spec:
  hostIPC: false
  hostNetwork: false
  hostPID: false
  containers:
    - name: app
      ports:
        - containerPort: 8080

Why: Host IPC exposes inter-process communication, host network removes network isolation, host PID exposes all host processes, host path mounts expose the host filesystem, and host ports create port conflicts and bypass network controls.

Network Policies

Workload namespaces should have a default deny-all NetworkPolicy for both ingress and egress traffic. After applying the default deny, add specific policies to allow only required traffic flows.

Required for: all profiles (optional, recommended best practice)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: app-ns
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

Then allow specific traffic:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-ingress
  namespace: app-ns
spec:
  podSelector:
    matchLabels:
      app: app
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend-ns
      ports:
        - port: 8080
          protocol: TCP

Port Management

Declare All Container Ports

All ports a container listens on must be declared in the container spec. Platforms may block undeclared ports.

Required for: Extended (mandatory), all others (optional)