To enforce zero network egress, define exactly which workloads and traffic paths are in scope, apply default-deny egress controls, and test both the policy configuration and live connectivity. In Kubernetes, an egress policy can isolate selected pods, but a policy object alone does not prove that traffic is blocked: the network plugin must enforce it, and paths such as host-network traffic may need separate controls. These tests can support a bounded claim about the workloads and connections tested; they do not, by themselves, prove data residency or legal sovereignty.
Define what “zero egress” means for your environment
“Zero egress” can mean either that no outbound connections are permitted or that outbound connections are denied by default except for explicitly approved destinations. Those are different policies. If DNS, an application endpoint, or another destination is allowed, the result is deny-by-default with exceptions—not literal zero egress.
As an Amazon Associate I earn from qualifying purchases.
For this guide, the boundary is Kubernetes pod egress under Kubernetes NetworkPolicy, with provider-specific controls considered where relevant. Kubernetes documents that pods are non-isolated for egress by default: outbound connections are allowed unless an applicable policy isolates them. Policies are namespace-scoped, and permitted egress is the union of the egress rules in policies that apply to a pod. A separate policy that allows a destination can therefore make that traffic permissible even when another policy is intended to restrict it. (Kubernetes, “Network Policies,” documentation accessed 2026-10-07.)
Before writing a policy, decide which namespaces, pods, IP families, protocols, destinations, and traffic paths the test must cover. Record approved exceptions and their business purpose. Include workloads that do not follow the ordinary pod network path—especially pods using hostNetwork—in the inventory, because Kubernetes documents uncertainty and limitations around their NetworkPolicy behavior.
#1 Best Overall
Apply a default-deny egress policy
A namespace-level default-deny policy selects every pod in that namespace and declares the Egress policy type without specifying any egress rules. For example, in namespace example:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-egress
namespace: example
spec:
podSelector: {}
policyTypes:
- EgressThis policy isolates the selected pods for egress. On its own, it allows no egress, including DNS. Add separate policies only for approved traffic, and review all policies selecting each workload because their allowed egress is additive. A policy manifest is not evidence of enforcement until a NetworkPolicy-capable network plugin is installed and enforcing the API.
Handle DNS as an explicit exception
If workloads need name resolution, permit only the intended resolver path and the required DNS protocol and port, and test that path from the workloads covered by the policy. Also test that alternate resolvers and unapproved destinations are blocked. The exact way to target a resolver depends on the cluster’s network and DNS implementation, so verify how the deployed plugin handles the relevant addresses and traffic.
A rule permitting port 53 to any IP is not equivalent to a narrowly scoped DNS exception. The CNCF’s 2020 guide warns that attackers may use DNS traffic to exfiltrate data even when other accidental outbound access is blocked. DNS permission should therefore be treated as an egress channel to control, not as harmless infrastructure traffic.
Automate configuration checks and live traffic tests
Use separate checks for desired configuration and observed behavior. Configuration checks can detect missing or overly broad policies; probes can show whether representative workloads can establish particular connections. Neither substitutes for the other.
1. Check coverage and policy intent
- Enumerate namespaces, pod selectors, approved exceptions, and workloads using nonstandard network paths. Confirm that every in-scope pod is selected by an egress-isolating policy.
- Inspect every policy that selects each tested pod. Verify that the combined allowed rules match the approved destinations, ports, protocols, and workload scope. Do not assume a restrictive policy overrides a separate allow rule.
- Check IPv4 and IPv6 separately when both are enabled or in scope. A test of one address family does not establish the behavior of the other.
Google Cloud Policy Controller documents the K8sRequireDefaultDenyEgressPolicy constraint template, which requires a default-deny egress NetworkPolicy in each namespace. The documented template version is 1.0.3. The constraint is referential: it must be configured to observe NetworkPolicy objects to evaluate the requirement. This can enforce a presence check, but it does not establish that a plugin enforces the policy or that every permitted rule is safe.
Rank #3
2. Verify the enforcement precondition
Confirm that the cluster’s CNI or other network plugin supports Kubernetes NetworkPolicy and that the relevant policy has taken effect. The Kubernetes API object records declared configuration; it does not, by itself, show that packets are being dropped. Kubernetes NetworkPolicy also has documented limitations, including undefined or uncertain behavior for some host-network cases, no service-name targeting, and no built-in network event logging. Where those paths matter, use and test additional enforcement or observation layers.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →3. Probe both permitted and forbidden destinations
From representative pods, attempt a connection to each required destination and confirm it succeeds. Then attempt connections to unapproved destinations and confirm they fail. Test the protocol and port actually used by the application, not only whether a hostname resolves.
- For IP or CIDR rules, test an address inside each approved range and addresses outside it.
- For domain-based rules, test an approved name, an unlisted name, and direct-IP connections to the resolved address and to other external addresses. This helps reveal whether the enforcement is genuinely tied to the intended domain policy or merely permits a broader IP path.
- Where IPv4 and IPv6 are in scope, include representative tests for both. The SIG Network FQDN proposal’s deny examples cover
0.0.0.0/0and::/0; ensure your own rules and probes account for both families where applicable. - Test DNS resolution through the approved resolver, then test alternate DNS destinations and paths. A successful lookup alone does not show that subsequent application traffic is permitted or denied as intended.
Run probes from workloads that match the actual policy selectors. A test pod with different labels, namespace placement, service account, or network mode may exercise a different set of controls.
4. Test policy changes and connection timing
After changing a rule, distinguish attempts to create new connections from traffic on connections that were already established. Google Cloud’s GKE documentation warns that established connections may remain active after an FQDN rule is removed until connection tracking closes them. Test the behavior your security requirement depends on, and do not interpret a surviving existing flow as proof that new connections are allowed.
5. Preserve evidence and state the boundary
For each automated run, retain the relevant policy state, workload identity and scope, test destinations and protocols, results, platform configuration, and execution time. The Kubernetes API does not provide built-in network event logging; if audit records of enforcement decisions are required, collect telemetry from the network enforcement layer or another suitable system.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsChoose an implementation that matches the boundary
| Mechanism | What it can check or control | Important qualification |
|---|---|---|
| Kubernetes NetworkPolicy | Namespace-scoped pod isolation and additive IP- or selector-based egress rules. | Requires a plugin that supports enforcement. DNS is blocked by default when egress is isolated unless separately allowed. It does not alone cover every node or host-network path. |
| Google Cloud Policy Controller constraint | Can require a default-deny egress NetworkPolicy in each namespace. | The documented constraint is referential and must observe NetworkPolicy objects. A presence requirement is not a live connectivity test. |
| SIG Network FQDN proposal examples | Illustrate FQDN allowlisting with default-deny examples, including IPv4 and IPv6 deny ranges. | Confirm the API version and controller behavior actually deployed; do not treat a proposal example as universal Kubernetes behavior. |
| GKE FQDN egress policies | Provide a Google Kubernetes Engine-specific option for controlling egress by fully qualified domain name. | Google documents that existing connections may persist after rule deletion until connection tracking closes them. Validate both new and established-flow behavior against the requirement. |
The Kubernetes policy API, SIG Network examples, and provider-specific behavior are not interchangeable. Compare options by enforcement scope, supported destination selectors, IPv4/IPv6 behavior, DNS handling, default-deny and allow-rule semantics, plugin or provider support, treatment of existing connections, and available telemetry. Then test the actual deployed implementation rather than inferring behavior from a manifest or example.
Keep egress tests separate from sovereignty evidence
Network controls can restrict tested outbound connections. They do not, by themselves, establish where data is stored or processed, which legal regime governs it, or whether every system capable of exporting data is covered. Those questions require evidence beyond pod egress policy, including a defined jurisdiction, workload and data inventory, and controls for paths outside the tested boundary.
A defensible test result is bounded: “The tested workloads could not establish the tested outbound connections under the tested policy and platform configuration.” State which workloads, destinations, address families, protocols, exceptions, and paths were included, and identify what was not tested. Avoid turning that result into a universal claim that no data can leave any system or that sovereignty requirements have been met.
Quick Recap
Sources
- Kubernetes, “Network Policies,” current documentation accessed 2026-10-07.
- Kubernetes, “Network Policies: API limitations and hostNetwork behavior,” current documentation accessed 2026-10-07.
- Google Cloud, “Constraint template library: K8sRequireDefaultDenyEgressPolicy,” current documentation accessed 2026-10-07; template version 1.0.3 shown.
- Kubernetes Network Policy API SIG, “NPEP-133: FQDN Selector for Egress Traffic,” accessed 2026-10-07.
- Google Cloud, “Control Pod egress traffic using FQDN network policies,” current product documentation accessed 2026-10-07.
- CNCF, “Guide to Kubernetes egress network policies,” published 2020-02-10.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
