Practice Now
Cluster Network Policy
Configuration Verification
Network Security
Kubernetes Networking
Policy Support

How to verify cluster network policy configuration/support

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
KubernetesNetworking & APIsSecurity & Auth

Introduction

Kubernetes NetworkPolicy resources are only enforced if the cluster's CNI (Container Network Interface) plugin supports them. Deploying a NetworkPolicy on a cluster without a compatible CNI plugin (like the default kubenet) silently does nothing — the policy exists as a Kubernetes object but has no effect on traffic. Verifying that your cluster actually enforces network policies requires checking the CNI plugin, deploying a test policy, and confirming that traffic is blocked as expected.

Check Your CNI Plugin

Not all CNI plugins support NetworkPolicy. You must verify which CNI is running in your cluster.

bash
1# Check which CNI plugin is installed
2kubectl get pods -n kube-system -l k8s-app=calico-node     # Calico
3kubectl get pods -n kube-system -l k8s-app=cilium           # Cilium
4kubectl get daemonset -n kube-system weave-net              # Weave Net
5kubectl get pods -n kube-system -l app=flannel              # Flannel (no NetworkPolicy support)
6
7# Check CNI config files on a node
8ls /etc/cni/net.d/
9# 10-calico.conflist  or  05-cilium.conf  etc.
CNI PluginNetworkPolicy Support
CalicoFull (ingress + egress)
CiliumFull (ingress + egress + L7)
Weave NetFull (ingress + egress)
FlannelNone
kubenetNone
Canal (Calico + Flannel)Full

Deploy a Test NetworkPolicy

Create a deny-all ingress policy and verify it blocks traffic.

yaml
1# deny-all.yaml — blocks all ingress to pods with label app=test-server
2apiVersion: networking.k8s.io/v1
3kind: NetworkPolicy
4metadata:
5  name: deny-all-ingress
6  namespace: policy-test
7spec:
8  podSelector:
9    matchLabels:
10      app: test-server
11  policyTypes:
12    - Ingress
13  ingress: []  # Empty — no ingress allowed
bash
1# Create test namespace and deploy test pods
2kubectl create namespace policy-test
3
4kubectl run test-server --image=nginx --labels=app=test-server -n policy-test
5kubectl run test-client --image=busybox --command -- sleep 3600 -n policy-test
6
7# Wait for pods to be ready
8kubectl wait --for=condition=ready pod/test-server -n policy-test --timeout=60s
9kubectl wait --for=condition=ready pod/test-client -n policy-test --timeout=60s
10
11# Verify connectivity BEFORE applying the policy
12kubectl exec -n policy-test test-client -- wget -qO- --timeout=3 http://test-server
13# Should return the nginx welcome page
14
15# Apply the deny-all policy
16kubectl apply -f deny-all.yaml
17
18# Test connectivity AFTER applying the policy
19kubectl exec -n policy-test test-client -- wget -qO- --timeout=3 http://test-server
20# Should timeout/fail if NetworkPolicy is enforced
21# If it still succeeds, your CNI does NOT support NetworkPolicy

Allow Specific Traffic

After confirming the deny-all policy works, add a policy that allows specific traffic.

yaml
1# allow-client.yaml
2apiVersion: networking.k8s.io/v1
3kind: NetworkPolicy
4metadata:
5  name: allow-test-client
6  namespace: policy-test
7spec:
8  podSelector:
9    matchLabels:
10      app: test-server
11  policyTypes:
12    - Ingress
13  ingress:
14    - from:
15        - podSelector:
16            matchLabels:
17              run: test-client
18      ports:
19        - protocol: TCP
20          port: 80
bash
1kubectl apply -f allow-client.yaml
2
3# test-client should now reach test-server
4kubectl exec -n policy-test test-client -- wget -qO- --timeout=3 http://test-server
5# Should succeed
6
7# Other pods should still be blocked
8kubectl run other-client --image=busybox --command -- sleep 3600 -n policy-test
9kubectl exec -n policy-test other-client -- wget -qO- --timeout=3 http://test-server
10# Should timeout — other-client is not allowed

Using CNI-Specific Tools to Verify

bash
1# Calico — check active policies
2kubectl get networkpolicies -n policy-test
3calicoctl get networkpolicy -n policy-test -o yaml
4
5# Cilium — check policy enforcement status
6kubectl exec -n kube-system cilium-xxxxx -- cilium policy get
7kubectl exec -n kube-system cilium-xxxxx -- cilium monitor --type policy-verdict
8
9# Cilium Hubble (observability)
10hubble observe --namespace policy-test --verdict DROPPED

Clean Up Test Resources

bash
kubectl delete namespace policy-test

Common Pitfalls

  • Assuming NetworkPolicy works without checking the CNI: The Kubernetes API accepts NetworkPolicy objects regardless of CNI support. On Flannel or kubenet, policies are created successfully but have zero effect on traffic. Always verify enforcement with a deny-all test before relying on policies.
  • Forgetting policyTypes field: Without specifying policyTypes, Kubernetes infers it from the rules present. An empty policy with no policyTypes and no rules does nothing. Always explicitly set policyTypes: ["Ingress"] or policyTypes: ["Ingress", "Egress"].
  • Not testing egress policies separately: Even if ingress policies work, egress enforcement may behave differently. Some CNI configurations enforce ingress but not egress by default. Test both directions independently.
  • Namespace-scoped confusion: NetworkPolicy is namespace-scoped. A policy in namespace A does not affect pods in namespace B. For cross-namespace restrictions, you need policies in both namespaces or use a CNI-specific cluster-wide policy (Calico GlobalNetworkPolicy, Cilium CiliumClusterwideNetworkPolicy).
  • DNS resolution breaking after deny-all egress: A deny-all egress policy blocks DNS (port 53) traffic to CoreDNS. Pods cannot resolve service names and appear to have no network connectivity. Always allow egress to DNS when applying egress policies: allow UDP port 53 to the kube-system namespace.

Summary

  • Verify your CNI plugin supports NetworkPolicy — Calico, Cilium, and Weave do; Flannel and kubenet do not
  • Deploy a deny-all policy and test with wget/curl from a client pod to confirm enforcement
  • Always explicitly set policyTypes in your NetworkPolicy spec
  • Use CNI-specific tools (calicoctl, Cilium Hubble) for detailed policy debugging
  • Allow DNS egress (UDP 53) when applying deny-all egress policies
  • Clean up test resources after verification
Related reading
Course
Beginner
27 lessons
10 hours
System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course
Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
Codemia
© 2026 Codemia
Resources
Legal
Social
All Rights Reserved.