How do I configure Kubernetes network policies for pod-to-pod communication?

Configuring Kubernetes Network Policies for pod-to-pod communication means defining rules that control traffic flow between pods. Network Policies are a Kubernetes resource that secures your cluster by limiting communication based on labels, namespaces, and IP blocks. Here’s a step-by-step guide:

1. Prerequisites

Network plugin: Ensure your cluster uses a CNI plugin that supports Network Policies — Calico, Cilium, Weave Net, or Kube-router, for example. Network Policies require a supported CNI.
Pod labels: Label your pods appropriately; Network Policies match based on labels.

2. Understand the Default Behavior

By default, Kubernetes allows all communication between pods.
Once you apply a NetworkPolicy to a set of pods (via podSelector), it denies all traffic to and from those pods unless the policy explicitly allows it.

3. Create a NetworkPolicy Resource

Network Policies are defined as YAML manifests. Here’s an example that allows traffic from specific pods:

Example: Allow traffic from specific pods

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-specific-pod-communication
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend

Explanation:

podSelector: Specifies the pods the policy applies to — here, pods labeled app: backend.
policyTypes: Defines the traffic direction (Ingress for incoming, Egress for outgoing).
ingress: Defines allowed incoming traffic sources. In this case, only pods labeled app: frontend can talk to app: backend.

4. Apply the NetworkPolicy

Use kubectl to apply the manifest:

kubectl apply -f allow-specific-pod-communication.yaml

5. Verify the NetworkPolicy

Confirm the policy exists and shows the expected rules:

kubectl describe networkpolicy allow-specific-pod-communication

Then test pod-to-pod connectivity from inside the pods using curl, wget, or ping.

6. Advanced Configuration

You can handle more complex scenarios:

Namespace-based policies

Allow traffic between pods in different namespaces:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-namespace-communication
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          team: dev

IP Block-based policies

Allow traffic from specific CIDR ranges:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ip-range
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 192.168.1.0/24

7. Debugging Tips

Verify pod labels match the podSelector in your policy.
Confirm the CNI plugin is installed and supports Network Policies.
Use kubectl logs or kubectl exec to troubleshoot connectivity between pods.