Kubernetes

NetworkPolicy Generator

Build a NetworkPolicy with ingress and egress peers, and the DNS exception egress rules need.

Policy

Name

Namespace

Direction

Applies to pods with these labels

Key

Value

Leave empty to select every pod in the namespace.

Deny all traffic

Declares the policy types with no rules, which blocks everything in those directions.

Allow ingress from

Peer 1

Pod labels

Key

Value

Or a CIDR block (for traffic outside the cluster)

Port

Protocol

Allow egress to

Peer 1

Pod labels

Key

Value

Or a CIDR block (for traffic outside the cluster)

Port

Protocol

Allow DNS to kube-dns

Without this, every name lookup from the selected pods fails — usually seen as connection timeouts rather than a policy error.

Output · NetworkPolicy

A NetworkPolicy is additive and deny-by-default per direction: once any policy selects a pod, only traffic explicitly allowed by some policy is permitted in the listed policyTypes. Pods no policy selects stay fully open.
NetworkPolicy is enforced by the CNI plugin. Flannel ignores it entirely; Calico, Cilium and the major managed CNIs enforce it. Verify yours does before relying on this.