Network policy

Writing network policies is how you restrict traffic to pods in your Kubernetes cluster. Calico extends the standard NetworkPolicy object to provide advanced network policy features, such as policies that apply to all namespaces.

Getting started

Adopt a zero trust network model for security

Best practices to adopt a zero trust network model to secure workloads and hosts. Learn 5 key requirements to control network access for cloud-native strategy.

Get started with Calico network policy

Create your first Calico network policies. Shows the rich features using sample policies that extend native Kubernetes network policy.

Calico policy tutorial

Learn how to create more advanced Calico network policies (namespace, allow and deny all ingress and egress).

Get started with Kubernetes network policy

Learn Kubernetes policy syntax, rules, and features for controlling network traffic.

Kubernetes policy, demo

An interactive demo that visually shows how applying Kubernetes policy allows and denies connections.

Kubernetes policy, basic tutorial

Learn how to use basic Kubernetes network policy to securely restrict traffic to/from pods.

Kubernetes policy, advanced tutorial

Learn how to create more advanced Kubernetes network policies (namespace, allow and deny all ingress and egress).

Enable a default deny policy for Kubernetes pods

Create a default deny network policy so pods that are missing policy are not allowed traffic until appropriate network policy is defined.

Policy rules

Basic rules

Define network connectivity for Calico endpoints using policy rules and label selectors.

Use namespace rules in policy

Use namespaces and namespace selectors in Calico network policy to group or separate resources. Use network policies to allow or deny traffic to/from pods that belong to specific namespaces.

Use service rules in policy

Use Kubernetes Service names in policy rules.

Use service accounts rules in policy

Use Kubernetes service accounts in policies to validate cryptographic identities and/or manage RBAC controlled high-priority rules across teams.

Use external IPs or networks rules in policy

Limit egress and ingress traffic using IP address either directly within Calico network policy or managed as Calico network sets.

Use ICMP/ping rules in policy

Control where ICMP/ping is used by creating a Calico network policy to allow and deny ICMP/ping messages for workloads and host endpoints.

Policy for hosts

Protect hosts

Calico network policy not only protects workloads, but also hosts. Create a Calico network policies to restrict traffic to/from hosts.

Protect Kubernetes nodes

Protect Kubernetes nodes with host endpoints managed by Calico.

Protect hosts tutorial

Learn how to secure incoming traffic from outside the cluster using Calico host endpoints with network policy, including allowing controlled access to specific Kubernetes services.

Apply policy to forwarded traffic

Apply Calico network policy to traffic being forward by hosts acting as routers or NAT gateways.

Policy for services

Apply Calico policy to Kubernetes node ports

Restrict access to Kubernetes node ports using Calico global network policy. Follow the steps to secure the host, the node ports, and the cluster.

Apply Calico policy to services exposed externally as cluster IPs

Expose Kubernetes service cluster IPs over BGP using Calico, and restrict who can access them using Calico network policy.

Policy for Istio

Enforce network policy for Istio

Enforce network policy for Istio service mesh including matching on HTTP methods and paths.

Use HTTP methods and paths in policy rules

Create a Calico network policy for Istio-enabled apps to restrict ingress traffic matching HTTP methods or paths.

Enforce Calico network policy using Istio (tutorial)

Learn how Calico integrates with Istio to provide fine-grained access control using Calico network policies enforced within the service mesh and network layer.

Securing component communications

Encrypt in-cluster pod traffic

Enable WireGuard for state-of-the-art cryptographic security between pods for Calico clusters.

Configure encryption and authentication to secure Calico components

Enable TLS authentication and encryption for various Calico components.

Schedule Typha for scaling to well-known nodes

Configure the Calico Typha TCP port.

Secure Calico Prometheus endpoints

Limit access to Calico metric endpoints using network policy.

Secure BGP sessions

Configure BGP passwords to prevent attackers from injecting false routing information.