> For the complete documentation index, see [llms.txt](https://docs.portainer.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.portainer.io/sts/admin/environments/policies/kubernetes-policies/create-a-kubernetes-network-security-policy.md). # Create a Kubernetes network security policy {% hint style="warning" %} This policy can only be applied to Edge (Standard) Agent environments that are of version 2.43.0 or greater. {% endhint %} Define a policy that sets ingress and egress traffic rules for pods across your Kubernetes environments. Portainer converts the policy into native Kubernetes `NetworkPolicy` objects and deploys them via Helm. To create a Kubernetes network security policy, from the menu, under **Environment-related**, select **Policies** then select **Create policy**. From the policy type list, navigate to the **Kubernetes** > **Network Security** section, select **Custom** then select **Continue** to begin configuring the policy. | Field/Option | Overview | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Name | Define a name for this policy. | | Environment groups |

Select one or more Kubernetes environment groups from the dropdown menu.
If the selected group is already included in an existing policy, a warning icon will appear next to the group name.

| | Namespaces |

The Kubernetes namespaces the rules in this policy apply to. At least one namespace must be selected.

Namespace scope is shared across all ingress and egress rules in the policy - it cannot be set per rule.

### Ingress rules Control which traffic is allowed into pods. A new policy starts with a `deny-all` ingress rule pre-added - remove it only if you intend to leave inbound traffic unrestricted. Each row in the table is one ingress rule. Rules are independent - each maps to its own Kubernetes `NetworkPolicy` object. Use **Add ingress rule** to open the rule modal. {% hint style="info" %} Kubernetes evaluates `NetworkPolicies` as an allow-list: if any policy permits a connection, it is allowed. A deny-all rule only blocks traffic if no other NetworkPolicy simultaneously allows it. {% endhint %}

		Cover image
Block all inbound	Drops all incoming traffic. Also add allow rules to selectively open ports.	/files/2T8c6VDAnyGHQR4ySreF
Allow all inbound	Permits all incoming traffic to pods. Use in dev environments or when auditing.	/files/W4MYnOVNWGxnpRGuBj95
Allow from ingress controller	Lets nginx (or similar) forward HTTP/S traffic into your pods. Targets pods with ingress-nginx labels in the `ingress-nginx` namespace.	/files/cY3AjglxjpxYbxleADkh
Allow from namespace	Permits traffic from all pods in a specific namespace. You supply the namespace name after selecting this preset.	/files/Yi9AQcK6ufsuLPAldjqm
Allow Prometheus	Opens port 9090 to Prometheus in the `monitoring` namespace - suitable for scraping metrics.	/files/0jTelLjU8gDqH2Z0N8yE
Custom	Build a rule from scratch with full control over all options.	/files/aUPBss1zsDPLf2k3WBam

### Egress rules Control which traffic pods are allowed to send out. No egress rules are pre-added - if you leave this list empty, outbound traffic from the selected pods is unrestricted. Each row is one egress rule. Use **Add egress rule** to open the rule modal. {% hint style="warning" %} If you add a **Block all outbound** rule, always also add an **Allow DNS** rule. Without DNS egress, pods cannot resolve hostnames and most application-level connectivity will silently fail. {% endhint %}

		Cover image
Block all outbound	Drops all outgoing traffic. Also add allow rules to selectively open destinations.	/files/2T8c6VDAnyGHQR4ySreF
Allow all outbound	Permits all outgoing traffic from pods. Use in dev environments or when auditing.	/files/W4MYnOVNWGxnpRGuBj95
Allow DNS	Required for pods to resolve hostnames. Opens UDP port 53 to `kube-dns` in the `kube-system` namespace.	/files/L5cDnd00l6THHDe1KKa0
Allow to namespace	Permits outbound traffic to all pods in a specific namespace. You supply the namespace name after selecting this preset.	/files/Yi9AQcK6ufsuLPAldjqm
Allow HTTPS outbound	Opens TCP port 443 so pods can reach external APIs and services over HTTPS.	/files/HvaK3tIgFFz77oaXxvEL
Custom	Build a rule from scratch with full control over all options.	/files/aUPBss1zsDPLf2k3WBam

### Rule configuration | Field/Option | Overview | | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | A unique identifier for this rule within the policy. Must be a valid DNS label: lowercase letters, digits, and hyphens only, maximum 63 characters. Names must be unique within the ingress list and within the egress list respectively. | | Pod selection |

All pods in namespace: The rule applies to every pod in the target namespace(s). This is the default for most presets.

Pods matching labels: The rule applies only to pods whose labels match all of the specified key-value pairs (logical AND). Add one or more label pairs.

Example: app=frontend, tier=web - matches pods that have both labels.

pods matching expression:
Select pods using a label selector expression. Each expression has a key, an operator, and optionally a set of values:

In - pod's label value is in the provided list
NotIn - pod's label value is not in the list
Exists - the label key exists (any value)
DoesNotExist - the label key is absent

| | Source Type |

Deny all: No traffic is permitted. Creates a NetworkPolicy with an empty peer list, blocking all connections to the selected pods.

Namespace: Traffic is allowed from (or to) all pods in a specific namespace.

Namespace pod label: Traffic is allowed from (or to) pods in a specific namespace that also carry a matching pod label.

Pod label only: Traffic is allowed from (or to) any pod cluster-wide that carries the specified label, regardless of namespace.

CIDR block: Traffic is allowed from (or to) an IP range. Commonly used for external services or for allowing traffic from specific node CIDRs.

Any: All traffic from (or to) any source is allowed for the selected pods on the specified port/protocol.

| | Port |

The port number this rule applies to. Leave blank to match traffic on any port. Most specific allow rules should set a port to avoid over-permitting. Select the protocol as
TCP (default) or UDP.

When you have completed the configuration, click **Create policy**. A confirmation screen displays the changes being made and any existing policy that will be replaced. Click **Confirm** to acknowledge the changes and create the policy.