A network address space is a CIDR-defined range of IP addresses used as a source or destination in a Kubernetes NetworkPolicy rule. IP blocks let administrators control traffic alongside pod selectors and namespace selectors. section 6.6 section 6.8
Use network address spaces when defining traffic boundaries:
- Permit or restrict traffic based on source or destination IP ranges. section 6.8
- Combine IP-based rules with ingress, egress, pod-selector, and namespace-selector rules. section 6.6 section 6.8
- Verify that the installed CNI implements NetworkPolicy behavior; creating the resource alone has no effect without implementation support. section 6.6
Policy traffic boundary
A NetworkPolicy can enforce default-deny behavior and then selectively permit communication from specified IP blocks, pods, or namespaces. Test the resulting path with kubectl and a client such as busybox. section 6.6 section 6.8
