Calico Network Policy Tier Evaluation

Calico Network Policy Tier Evaluation A workflow diagram generated by Archify. 01 / Policy evaluation (ascending order) EX / Rule match → immediate exit Security Tier · security team Platform Tier · platform team Application Tier · app teams Default Tier · built-in Packet arrives · Pod ingress / egress · Policy evaluation (ascending order) Packet arrives Pod ingress / egress GlobalNetworkPolicy · order 100 · block threat IPs · Policy evaluation (ascending order) › Security Tier · security team · security.block-threats GlobalNetworkPolicy order 100 · block threat IPs security.block-threats GlobalNetworkPolicy · order 200 · DNS + API baseline · Policy evaluation (ascending order) › Platform Tier · platform team · platform.baseline GlobalNetworkPolicy order 200 · DNS + API baseline platform.baseline Calico NetworkPolicy · order 500 · frontend → backend · Policy evaluation (ascending order) › Application Tier · app teams · application.frontend-rules Calico NetworkPolicy order 500 · frontend → backend application.frontend-rules K8s NetworkPolicy · order 1000 · deny / allow · Policy evaluation (ascending order) › Default Tier · built-in · Kubernetes standard API K8s NetworkPolicy order 1000 · deny / allow Kubernetes standard API Profile default · no policy matched · Policy evaluation (ascending order) Profile default no policy matched Allow / Deny · e.g. threat-intel → Deny · Rule match → immediate exit › Security Tier · security team Allow / Deny e.g. threat-intel → Deny Allow / Deny · e.g. kube-dns → Allow · Rule match → immediate exit › Platform Tier · platform team Allow / Deny e.g. kube-dns → Allow Allow / Deny · e.g. backend:8080 → Allow · Rule match → immediate exit › Application Tier · app teams Allow / Deny e.g. backend:8080 → Allow Allow / Deny · no Pass · decided here · Rule match → immediate exit › Default Tier · built-in Allow / Deny no Pass · decided here Pass no match Pass Pass Legend Immediate exit Tier policy Profile default action Incoming traffic

Decision actions

  • • Allow: a rule match permits the traffic and ends evaluation
  • • Deny: a rule match blocks the traffic and ends evaluation
  • • Pass: defers the decision to the next tier

Tier ownership

  • • security (100) security team · platform (200) platform team · application (500) app teams
  • • RBAC scopes each team to the policies in its own tier
  • • Every Kubernetes NetworkPolicy lives in the Default tier

Final default action

  • • The Default tier (order 1000) is evaluated last
  • • K8s NetworkPolicy has no Pass action
  • • If no tier matches, the endpoint profile's default action applies