# Automated network policies on namespaces **URL:** \ **Category:** General Discussions\ **Tags:** network\ **Created:** [April 12, 2022, 9:48am UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635 "2022-04-12T09:48:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![thijslemmens](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/thijslemmens/32/9867_2.png) [@thijslemmens](https://discuss.kubernetes.io/u/thijslemmens)\ **Post date:** [April 12, 2022, 9:48am UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635/1 "2022-04-12T09:48:41Z")
Hello I want to deploy multiple applications to a Kubernetes cluster. These applications can consist of multiple pods that interact with each other. However, I want to isolate the applications from each other for security reasons. I’m coming from Docker Swarm where you deploy a docker-compose.yml an overlay network is created per stack you deploy. On Kubernetes, I was planning to put each application in it’s own namespaces and define network policies so that pods can only communicate with pods inside the namespace (with exceptions ofcourse). However, I don’t want to do this again for every application and namespace I create. I was thinking to write an Operator to watch the namespaces and automatically create the necessary network policies. However, before starting an implementation, I would like to get some feedback on this approach. I’m probably not the only one with these requirements, and others have probably implemented similar things. Is my approach valid, and are there things I can use that are already out there? I could not find them, but I might not be searching with the correct terms. ### Cluster information: Kubernetes version: 1.23.4 Cloud being used: Scaleway Installation method: Kapsule (managed) CNI and version: Cilium ---
**Author:** ![thijslemmens](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/thijslemmens/32/9867_2.png) [@thijslemmens](https://discuss.kubernetes.io/u/thijslemmens)\ **Post date:** [April 12, 2022, 2:53pm UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635/2 "2022-04-12T14:53:33Z")
I got some help on Slack: ```auto [mimmus] Kyverno can probably be easier for you https://kyverno.io/policies/best-practices/add_network_policy/ [thijs lemmens] thanks for that suggestion, I did not know that tool yet [mimmus] great tool! [ArgTang] You can aslo check if ciliums networkpolicy https://docs.cilium.io/en/v1.9/concepts/kubernetes/policy/#ciliumclusterwidenetworkpolicy [thijs lemmens] that seems like a good option as well ``` ---
**Author:** ![thockin](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/thockin/32/2457_2.png) [@thockin](https://discuss.kubernetes.io/u/thockin)\ **Post date:** [April 12, 2022, 3:07pm UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635/3 "2022-04-12T15:07:07Z")
What you want is AdminNetworkPolicy, which is still in development ☹ Until then, a trivial operator can do this. ---
**Author:** ![thijslemmens](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/thijslemmens/32/9867_2.png) [@thijslemmens](https://discuss.kubernetes.io/u/thijslemmens)\ **Post date:** [April 13, 2022, 6:55am UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635/4 "2022-04-13T06:55:11Z")
Good to know. I’ll keep an eye on the issue so I can replace any custom solution with the Kubernetes feature once it is there: > > > \# Enhancement Description > \- One-line enhancement description (can be used as a …release note): Introduce cluster scoped AdminNetworkPolicy API. > \- Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/2091-admin-network-policy > \- Discussion Link: https://www.youtube.com/watch?v=yX1nFb3DS3A&list=PL69nYSiGNLP2E8vmnqo5MwPOY25sDWIxb Minute 29:00 > \- Primary contact (assignee): @abhiraut > \- Responsible SIGs: sig-network > \- Enhancement target (which target equals to which milestone): > - Alpha release target (x.y) - v1.24 > - Beta release target (x.y) - v1.26 > - Stable release target (x.y) - v1.28 > > \_Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.\_ > > /sig network ---
**Author:** ![sanchit\_raj](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/sanchit_raj/32/12890_2.png) [@sanchit\_raj](https://discuss.kubernetes.io/u/sanchit_raj)\ **Post date:** [July 14, 2023, 8:49am UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635/5 "2023-07-14T08:49:50Z")
apiVersion: [networking.k8s.io/v1](http://networking.k8s.io/v1) kind: NetworkPolicy metadata: name: all-port-from-namespace #This line is changed namespace: echo #This line should be changed spec: podSelector: matchLabels: {} ingress: - from: - namespaceSelector: matchLabels: name: internal #This line is changed - podSelector: {} ports: - port: 9000 ---
**Author:** ![linuxrepo01](https://avatars.discourse-cdn.com/v4/letter/l/5e9695/32.png) [@linuxrepo01](https://discuss.kubernetes.io/u/linuxrepo01)\ **Post date:** [May 30, 2024, 6:36pm UTC](https://discuss.kubernetes.io/t/automated-network-policies-on-namespaces/19635/7 "2024-05-30T18:36:06Z")
no need to mention podselector right? I would say apiVersion: [networking.k8s.io/v1](http://networking.k8s.io/v1) kind: NetworkPolicy metadata: name: allow-port-from-namespace namespace: fubar spec: podSelector: {} policyTypes: - Ingress ingress: - from: - namespaceSelector: matchLabels: [kubernetes.io/metadata.name:](http://kubernetes.io/metadata.name:) internal ports: - protocol: TCP port: 9000