Docs

Volcengine Kubernetes Engine

Container Network

Using a NetworkPolicy for network access control

A Kubernetes NetworkPolicy implements policy-based network access control. You can use a NetworkPolicy to control pod traffic by IP address or port. This topic describes the configuration methods and use cases of NetworkPolicies.

tip

[Beta - apply for trial]: This feature is currently in beta. To use it, submit an application.

For details about NetworkPolicies in Kubernetes, see Network Policies.

Usage limits

VKE NetworkPolicies are supported only in clusters that use the VPC-CNI network model.

The vpc-cni add-on must be upgraded to version v1.6.4 or later.

NetworkPolicy implementation for VCI differs from that for VKE and requires independent configuration. For details, see Using a NetworkPolicy to implement network access control for VCI Pods.

When using a NetworkPolicy to control traffic, consider cluster scale limitations. For details, see Limit.

A NetworkPolicy does not support the following scenarios.

should allow egress access to server in CIDR block

should deny ingress access to updated pod

should allow ingress access from updated pod

should enforce except clause while egress access to server in CIDR block

should enforce ingress policy allowing any port traffic to a server on a specific protocol [Feature:UDP]

should ensure an IP overlapping both IPBlock.CIDR and IPBlock.Except is allowed

should properly isolate pods that are selected by a policy allowing SCTP, even if the plugin doesn't support SCTP

Procedure

Step 1: Enable NetworkPolicy

In the left navigation bar, click Cluster. On the page that appears, click the name of the target cluster to go to the management page of the cluster.

In the left navigation bar, click Addons.

On the Network tab, find the vpc-cni add-on, move the mouse over the add-on card, click Configuration, and enable the NetworkPolicy feature.

Note

It takes about 1 minute for NetworkPolicy to take effect after being enabled (or disabled).

Modifying this configuration causes the add-on to restart. Perform this operation during off-peak hours.

Click Confirm.

Step 2: Configure a NetworkPolicy

After enabling the NetworkPolicy feature, you can specify a network policy for specific pods by configuring a NetworkPolicy. In the NetworkPolicy, you define traffic direction by using ingress and egress, and you filter ingress and egress targets (namespaces and pods) by using ipBlock, namespaceSelector, and podSelector.

The following content provides an example configuration and a description of key fields.

Key fields are described in the table below:

Parameter	Description
policyTypes	Specify the traffic control direction in the NetworkPolicy policy. Options include: Ingress: Ingress traffic policy for controlling external traffic entering specified pods. Egress: Egress traffic policy for controlling access to external destinations by specified pods.
ipBlock	Static CIDR block. This field is used to specify IP addresses external to the cluster. Traffic between pods and specified external IP addresses will be controlled by the NetworkPolicy policy. tip This field only supports IP addresses external to the cluster and does not support internal cluster addresses, such as IP addresses of nodes.
namespaceSelector	Namespace selector. It selects, by label, the namespaces that require network traffic control. All pods in the matched namespaces are governed by the NetworkPolicy.
podSelector	Pod selector. It selects pods that need network traffic control by label. Pods that meet the filter conditions are governed by the NetworkPolicy.

Validating results

Confirming configurations

In the left navigation bar, click Workload > Resource Explorer.

From the Category drop-down list, select API Group and use the name networking.k8s.io to search for the resource object.

Click the resource name to enter the resource details page, where you can see the NetworkPolicy resource category.

Click the name of the NetworkPolicy resource to enter the resource details page, where you can view, modify, or delete the NetworkPolicy configuration.

Checking traffic

After the configuration is complete, you can create multiple workloads in the cluster and verify whether the configured traffic rules in the NetworkPolicy are applied effectively to pods. For example, if you allow only mutual access within the same namespace, deploy multiple pods in different namespaces. Log in to a pod and run the ping command to verify that it can access only other pods in the same namespace and cannot access pods in other namespaces. The example is as follows:

Configuration examples

Allowing mutual access within the same namespace

The following YAML configuration example defines a NetworkPolicy that only allows pods within the same namespace to access each other and prevents pod access across namespaces.

Denying all inbound traffic

The following YAML configuration example defines a NetworkPolicy that denies any inbound traffic (pods cannot be accessed by any object).

Allowing access only from a specified namespace

The following YAML configuration example defines a NetworkPolicy that only allows pods in the namespace with the name: demo-workspace label to access other pods in the cluster.

Allowing access only to a specified namespace

The following YAML configuration example defines a NetworkPolicy that only allows pods in the cluster to access pods in the namespace with the name: demo-workspace label.

Allowing access only to a specified CIDR block

The following YAML configuration example defines a NetworkPolicy that only allows pods in the cluster to access external objects within the CIDR block 172.16.0.0/16, over TCP, and on port 8080. It prevents access to other network objects or ports.

Allowing access only from a specified CIDR block

The following YAML configuration example defines a NetworkPolicy that only allows pods in the cluster to be accessed by external objects within the CIDR block 172.16.0.0/16 via TCP and port 80.

Last updated: 2026.09.03 15:56:09