<p>answer: the book is correct; the {} block selects everything.</p>
<p>Here is my understanding about how the default deny all policy works:</p>
<p>from <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/</a></p>
<p>&quot;By default, a pod is non-isolated for ingress; all inbound connections are allowed.</p>
<p><code>A pod is isolated for ingress if there is any NetworkPolicy that both selects the pod and has &quot;Ingress&quot; in its policyTypes</code>; we say that such a policy applies to the pod for ingress. When a pod is isolated for ingress, <code>the only allowed connections into the pod are those from the pod's node and those allowed by the ingress list of some NetworkPolicy that applies to the pod for ingress</code>. Reply traffic for those allowed connections will also be implicitly allowed. The effects of those ingress lists combine additively.&quot;</p>
<p>So when all pods are selected with policyTypes of &quot;Ingress&quot;, all pods are isolated.</p>
<p>Since there is no <code>ingress:</code> block in this policy, nothing is allowed.</p>

CC BY-SA 4.0
2024-10-11T13:18:46.073Z
2024-10-11T13:18:46.073Z
sqr
<p>I am referring to the below paragraph from Certified Kubernetes Security Specialist (CKS) Study Guide By Benjamin Muschko · 2023.</p>
<p><a href="https://i.sstatic.net/JfBmWII2.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/JfBmWII2.png" alt="enter image description here" /></a></p>
<p>since I am a bit curious to know how the precedence of NetworkPolicy are determined in k8s, I tried to search around, and I found from <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-and-all-egress-traffic" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-and-all-egress-traffic</a>,</p>
<p><a href="https://i.sstatic.net/zn2TUG5n.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zn2TUG5n.png" alt="enter image description here" /></a></p>
<p>so my understanding is that K8s network policies is to define 'allowed policies', insead of 'denied policies', and the {} selector is to selecting <code>none</code> instead of selecting <code>all</code>.</p>
<p>so the explaination in the CKS study guide book is a bit misleading.</p>
<p>Am I getting this correctly?</p>
<p>can someone wiht k8s knowledge help to clarify this?</p>
<p>thanks!</p>

<kubernetes><networking>
question on the meaning of `{}` in k8s NetworkPolicy
sqr
# question on the meaning of `{}` in k8s NetworkPolicy

(Asked by: username_0 on 2024-10-11)

I am referring to the below paragraph from Certified Kubernetes Security Specialist (CKS) Study Guide By Benjamin Muschko · 2023.

[![enter image description here](https://i.sstatic.net/JfBmWII2.png)](https://i.sstatic.net/JfBmWII2.png)

since I am a bit curious to know how the precedence of NetworkPolicy are determined in k8s, I tried to search around, and I found from <https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-and-all-egress-traffic>,

[![enter image description here](https://i.sstatic.net/zn2TUG5n.png)](https://i.sstatic.net/zn2TUG5n.png)

so my understanding is that K8s network policies is to define 'allowed policies', insead of 'denied policies', and the {} selector is to selecting `none` instead of selecting `all`.

so the explaination in the CKS study guide book is a bit misleading.

Am I getting this correctly?

can someone wiht k8s knowledge help to clarify this?

thanks!

**Tags:** kubernetes, networking


---

## 1 answers

### Answer by username_0 on 2024-10-11. Score: 0

answer: the book is correct; the {} block selects everything.

Here is my understanding about how the default deny all policy works:

from <https://kubernetes.io/docs/concepts/services-networking/network-policies/>

"By default, a pod is non-isolated for ingress; all inbound connections are allowed.

`A pod is isolated for ingress if there is any NetworkPolicy that both selects the pod and has "Ingress" in its policyTypes`; we say that such a policy applies to the pod for ingress. When a pod is isolated for ingress, `the only allowed connections into the pod are those from the pod's node and those allowed by the ingress list of some NetworkPolicy that applies to the pod for ingress`. Reply traffic for those allowed connections will also be implicitly allowed. The effects of those ingress lists combine additively."

So when all pods are selected with policyTypes of "Ingress", all pods are isolated.

Since there is no `ingress:` block in this policy, nothing is allowed.


---

