Considerations for Kubernetes network policy

Understand how Kubernetes NetworkPolicy interacts with ambient mesh, including required port exceptions for HBONE tunneling.

Kubernetes NetworkPolicy controls L4 traffic to and from your pods, enforced by your cluster’s CNI plugin. Istio is not a CNI and does not manage NetworkPolicy; ambient mesh never bypasses it.

This means that a misconfigured NetworkPolicy can block Istio traffic or impair mesh functionality. Review the following considerations for using Kubernetes NetworkPolicy alongside ambient mesh.

Allowing HBONE traffic

When you add applications to an ambient mesh, the secure overlay layer tunnels traffic between pods using HBONE on port 15008. NetworkPolicy is enforced on the host outside the pod, so any policy that does not allow port 15008 blocks HBONE traffic.

For example, the following policy restricts inbound traffic to my-app to port 8080 only, which blocks HBONE.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  ingress:
  - ports:
    - port: 8080
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/name: my-app

To resolve this, add port 15008 to the ingress rules to allow HBONE traffic.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  ingress:
  - ports:
    - port: 8080
      protocol: TCP
    - port: 15008
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/name: my-app

Health probes

Kubernetes health check probes originate from the kubelet process on the node, not from another pod in the cluster. They are plaintext and unauthenticated. The kubelet has no cryptographic identity, so identity-based access control is not possible.

Ambient mesh handles this by using iptables rules and source NAT (SNAT) to rewrite packets that provably originate from the local node with a fixed link-local address (169.254.7.127). These packets are then explicitly excluded from Istio policy enforcement as unauthenticated health probe traffic.

If your workload, namespace, or cluster has a preexisting NetworkPolicy, your CNI may block packets from this link-local address, causing health probes to fail after you enroll pods in the mesh.

For example, the following policy blocks all ingress traffic to my-app, including kubelet health probes.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: my-app
  policyTypes:
  - Ingress

Update the policy to explicitly allow traffic from the link-local address ambient uses for health probes.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress-allow-kubelet-healthprobes
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: my-app
  ingress:
    - from:
      - ipBlock:
          cidr: 169.254.7.127/32