Why Default Kubernetes Networking Is Wrong

Fresh Kubernetes cluster:

Every pod can talk to every other pod

Across namespaces, across services, across environments

No egress restrictions

No ingress restrictions

This is a lateral movement attack waiting to happen. One compromised pod = entire cluster.

Network Policies fix this. Most teams ignore them until the first security audit.

A Simple Rule That Breaks Things

Start with: "deny all traffic by default, explicitly allow what you need."

apiVersion : networking.k8s.io/v1 kind : NetworkPolicy metadata : name : default-deny-all namespace : production spec : podSelector : {} policyTypes : - Ingress - Egress

Enter fullscreen mode

Exit fullscreen mode

Apply this to a running namespace, and everything breaks :

Pods can't reach DNS (kube-dns is in kube-system )

Pods can't reach the API server

Metrics scraping fails

Service mesh control plane loses connectivity

This is not a bug. This is the point.…