Create a Kubernetes network security policy

This policy can only be applied to Edge (Standard) Agent environments that are of version 2.43.0 or greater.

Define a policy that sets ingress and egress traffic rules for pods across your Kubernetes environments. Portainer converts the policy into native Kubernetes NetworkPolicy objects and deploys them via Helm.

To create a Kubernetes network security policy, from the menu, under Environment-related, select Policies then select Create policy. From the policy type list, navigate to the Kubernetes > Network Security section, select Custom then select Continue to begin configuring the policy.

Field/Option	Overview
Name	Define a name for this policy.
Environment groups	Select one or more Kubernetes environment groups from the dropdown menu. If the selected group is already included in an existing policy, a warning icon will appear next to the group name.
Namespaces	The Kubernetes namespaces the rules in this policy apply to. At least one namespace must be selected. Namespace scope is shared across all ingress and egress rules in the policy - it cannot be set per rule.

Ingress rules

Control which traffic is allowed into pods. A new policy starts with a deny-all ingress rule pre-added - remove it only if you intend to leave inbound traffic unrestricted.

Each row in the table is one ingress rule. Rules are independent - each maps to its own Kubernetes NetworkPolicy object. Use Add ingress rule to open the rule modal.

Kubernetes evaluates NetworkPolicies as an allow-list: if any policy permits a connection, it is allowed. A deny-all rule only blocks traffic if no other NetworkPolicy simultaneously allows it.

Block all inbound

Drops all incoming traffic. Also add allow rules to selectively open ports.

Allow all inbound

Permits all incoming traffic to pods. Use in dev environments or when auditing.

Allow from ingress controller

Lets nginx (or similar) forward HTTP/S traffic into your pods. Targets pods with ingress-nginx labels in the ingress-nginx namespace.

Allow from namespace

Permits traffic from all pods in a specific namespace. You supply the namespace name after selecting this preset.

Allow Prometheus

Opens port 9090 to Prometheus in the monitoring namespace - suitable for scraping metrics.

Custom

Build a rule from scratch with full control over all options.

Egress rules

Control which traffic pods are allowed to send out. No egress rules are pre-added - if you leave this list empty, outbound traffic from the selected pods is unrestricted.

Each row is one egress rule. Use Add egress rule to open the rule modal.

If you add a Block all outbound rule, always also add an Allow DNS rule. Without DNS egress, pods cannot resolve hostnames and most application-level connectivity will silently fail.

Block all outbound

Drops all outgoing traffic. Also add allow rules to selectively open destinations.

Allow all outbound

Permits all outgoing traffic from pods. Use in dev environments or when auditing.

Allow DNS

Required for pods to resolve hostnames. Opens UDP port 53 to kube-dns in the kube-system namespace.

Allow to namespace

Permits outbound traffic to all pods in a specific namespace. You supply the namespace name after selecting this preset.

Allow HTTPS outbound

Opens TCP port 443 so pods can reach external APIs and services over HTTPS.

Custom

Build a rule from scratch with full control over all options.

Rule configuration

Field/Option	Overview
Name	A unique identifier for this rule within the policy. Must be a valid DNS label: lowercase letters, digits, and hyphens only, maximum 63 characters. Names must be unique within the ingress list and within the egress list respectively.
Pod selection	All pods in namespace: The rule applies to every pod in the target namespace(s). This is the default for most presets. Pods matching labels: The rule applies only to pods whose labels match all of the specified key-value pairs (logical AND). Add one or more label pairs. Example: app=frontend, tier=web - matches pods that have both labels. pods matching expression: Select pods using a label selector expression. Each expression has a key, an operator, and optionally a set of values: In - pod's label value is in the provided list NotIn - pod's label value is not in the list Exists - the label key exists (any value) DoesNotExist - the label key is absent
Source Type	Deny all: No traffic is permitted. Creates a NetworkPolicy with an empty peer list, blocking all connections to the selected pods. Namespace: Traffic is allowed from (or to) all pods in a specific namespace. Namespace pod label: Traffic is allowed from (or to) pods in a specific namespace that also carry a matching pod label. Pod label only: Traffic is allowed from (or to) any pod cluster-wide that carries the specified label, regardless of namespace. CIDR block: Traffic is allowed from (or to) an IP range. Commonly used for external services or for allowing traffic from specific node CIDRs. Any: All traffic from (or to) any source is allowed for the selected pods on the specified port/protocol.
Port	The port number this rule applies to. Leave blank to match traffic on any port. Most specific allow rules should set a port to avoid over-permitting. Select the protocol as TCP (default) or UDP.

When you have completed the configuration, click Create policy. A confirmation screen displays the changes being made and any existing policy that will be replaced. Click Confirm to acknowledge the changes and create the policy.