CME-209
Kubernetes NetworkPolicy Enforcement
Description
Kubernetes-native network segmentation via NetworkPolicy resources that define pod-level ingress and egress rules. Enforces default-deny network posture and explicit allow rules based on pod selectors, namespace selectors, and IP blocks. Prevents lateral movement within cluster by restricting pod-to-pod communication to explicitly allowed paths. Requires CNI plugin support (Calico, Cilium, Weave, Antrea). Policies are namespace-scoped and stack additively.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | N → A | Network attack vector restricted to adjacent pods/namespaces; default-deny blocks lateral movement |
| Scope (S) | C → U | Scope change prevented; compromised pod cannot reach other namespaces without explicit policy |
CWE Relationships
Verification
Verify NetworkPolicy resources exist and CNI enforces them
$ kubectl get networkpolicy -A
# Expected: NetworkPolicy resources exist for sensitive namespaces
# Expected: NetworkPolicy resources exist for sensitive namespaces
Platform: kubernetes
$ kubectl describe networkpolicy <policy-name> -n <namespace> | grep -E 'policyTypes|Ingress|Egress'
# Expected: policyTypes includes Ingress and/or Egress with rules defined
# Expected: policyTypes includes Ingress and/or Egress with rules defined
Platform: kubernetes
$ kubectl get networkpolicy -n <namespace> -o jsonpath='{.items[?(@.spec.podSelector.matchLabels=={})].metadata.name}'
# Expected: default-deny policy exists (empty podSelector = all pods)
# Expected: default-deny policy exists (empty podSelector = all pods)
Platform: kubernetes
$ kubectl get pods -n kube-system -l 'k8s-app in (calico-node, cilium, weave-net, antrea-agent)' | grep -c Running
# Expected: >0 (CNI plugin running)
# Expected: >0 (CNI plugin running)
Platform: kubernetes