Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTo isolate AI-agent Pods in Kubernetes, select them with a NetworkPolicy, isolate their ingress and egress, then add allow rules for only the required peers and ports. Start with default-deny, explicitly account for DNS and other platform dependencies, and test both permitted and blocked traffic in the cluster: a policy object alone does not guarantee enforcement. NetworkPolicy is a useful network-layer boundary, not agent identity, tool authorization, prompt-injection protection, or a complete execution sandbox.
What NetworkPolicy can—and cannot—control
A NetworkPolicy selects Pods in its own namespace using podSelector. An empty selector ({}) selects every Pod in that namespace; labels let you narrow the boundary to agent workloads. A policy can isolate selected Pods for ingress, egress, or both, as described in the Kubernetes NetworkPolicy API reference.
As an Amazon Associate I earn from qualifying purchases.
NetworkPolicy is a Layer 3/4 control: it governs network traffic by peer and port. It does not inherently match a hostname, HTTP path, MCP tool name, agent identity, or the intent of a model-generated action. For those controls, use an appropriate gateway, service mesh, or agent-aware authorization layer and confirm its implementation and maturity rather than assuming ordinary NetworkPolicy provides them.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How isolation and policy rules work
Pods are unrestricted in a direction until a NetworkPolicy isolates them for that direction. Once isolated, only traffic allowed by applicable policies is permitted. Kubernetes documents a local-node exception for ingress and allows reply traffic for permitted connections. See Kubernetes Network Policies for the behavioral details.
#1 Best Overall
- Ingress: A policy selects the destination Pods whose inbound traffic it governs. Its ingress peers identify allowed sources.
- Egress: A policy selects the source Pods whose outbound traffic it governs. Its egress peers identify allowed destinations.
- Pod-to-Pod connections: If the source is isolated for egress, its egress rules must permit the connection. If the destination is isolated for ingress, its ingress rules must also permit it.
- Policies combine additively: Applicable ingress rules form a union, as do applicable egress rules. Policies have no ordering or deny precedence; another applicable allow rule can broaden access.
A peer can use a Pod selector, namespace selector, IP block, or supported combinations. When a single peer entry combines namespace and Pod selectors, both conditions apply: the Pod must match the Pod labels and be in a namespace matching the namespace labels. YAML indentation and nesting determine whether selectors are combined in one peer or treated as separate peers.
Choose a boundary and establish default-deny
Use labels reserved for the workload role and trust boundary, such as app: ai-agent, and verify which Pods actually carry them. A namespace-wide policy is appropriate only if every Pod in that namespace should share the same boundary. Kubernetes documents the following default-deny pattern; the first policy selects only agent Pods, while the namespace-wide alternative uses podSelector: {}.
Rank #2
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: agent-default-deny
namespace: app
spec:
podSelector:
matchLabels:
app: ai-agent
policyTypes:
- Ingress
- Egress
ingress: []
egress: []To isolate every Pod in the namespace instead, replace that policy’s podSelector with {}. Keep policyTypes explicit: an empty egress list by itself does not necessarily declare Egress as a policy type. If policyTypes is omitted, Ingress is included by default, and Egress is included when the policy has egress rules. The default-deny behavior and policy-type rules are documented in the Kubernetes Network Policies guide and API reference.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Add only the required communication paths
The following illustrative allow policy permits inbound traffic from a frontend Pod in a namespace labeled kubernetes.io/metadata.name: app, outbound traffic to a tool-server Pod in the same namespace, and DNS queries to matching Pods in kube-system. The workload labels, namespace, DNS labels, and ports must match the target cluster and application. In particular, verify the actual DNS Pods and service configuration rather than assuming every cluster uses the same labels or DNS destination.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: agent-required-flows
namespace: app
spec:
podSelector:
matchLabels:
app: ai-agent
policyTypes:
- Ingress
- Egress
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: app
podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: tool-server
ports:
- protocol: TCP
port: 8080
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53In this example, the combined namespace and Pod selectors in each peer constrain the peer to Pods meeting both label conditions. The egress rules name the tool-server Pods and DNS Pods, not a universal service list. If the agent needs a model endpoint, telemetry collector, credential broker, or other dependency, determine its actual destination and required port from the workload design and add a narrowly scoped rule only when supported by the cluster’s policy implementation. Do not assume that allowing DNS also permits connections to the IP addresses returned by DNS.
DNS is an explicit dependency
Default-deny egress blocks DNS unless a rule permits it. The DNS example above allows UDP and TCP port 53 only to Pods in the selected namespace that carry the stated label. Confirm the DNS service’s actual namespace, backing Pod labels, and ports in your cluster; adapt the peer accordingly. A different DNS architecture may require a different allowance.
Rank #4
Review all policies selecting the agent Pods
The allow policy adds to the default-deny policy; it does not override it. Inspect every NetworkPolicy whose selector matches the agents. A broad rule in another applicable policy can permit traffic beyond the paths shown here, because Kubernetes does not evaluate these policies in order or give default-deny a special precedence.
Deploy and validate the policy
- Confirm the selector boundary. Check that intended agent Pods have the reserved labels and that unrelated Pods do not. Decide whether the policy should cover those agents only or every Pod in the namespace.
- Inventory dependencies. Identify required inbound callers and outbound services, ports, DNS, model endpoints, tool servers, telemetry, and credential brokers from the actual workload architecture. Avoid a guessed universal port list.
- Apply isolation and allow rules. Create default-deny for the desired direction or directions, then add narrow ingress and egress rules for necessary paths. Inspect the full set of policies that select the Pods.
- Verify enforcement support. Confirm that the cluster’s network plugin supports and enforces NetworkPolicy. The Kubernetes Application Security Checklist specifically calls out whether policy is available and enforced; creating a resource is not proof that traffic is filtered.
- Test allowed and denied paths. From representative agent Pods, verify that intended calls—including name resolution where needed—succeed, and that unintended ingress and egress are blocked. Repeat in the target cluster and after relevant networking or policy changes.
Why network containment is not agent authorization
Network restrictions can limit reachable destinations and reduce opportunities for lateral movement or data exfiltration, but they cannot inspect prompt content or decide whether an allowed endpoint is being used safely. OWASP identifies risks including direct and indirect prompt injection, tool abuse and privilege escalation, data exfiltration, and memory poisoning in its AI Agent Security Cheat Sheet.
Pair network controls with distinct workload identities, authorization for individual tools and actions, auditing, and suitable runtime isolation. A NetworkPolicy rule permitting traffic to a tool server does not authorize every function exposed by that server. Kubernetes SIG Agentic Networking describes broader goals such as agent identity, fine-grained authorization, protocol-aware capabilities, and auditable traffic management; these are evolving project goals, not universal built-in NetworkPolicy features. See the SIG Agentic Networking introduction and verify the maturity and availability of any implementation before relying on it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
