Cut One Node Out of a Service's Allowed Callers

Scenario

Namespace ledger holds three Pods, each on a different node:

ledger-api serves two ports. 8080 is the API other services call, 9090 is an admin endpoint that should not be public. The Service publishes both on the same numbers, so from inside the namespace:

curl http://ledger-api:8080
curl http://ledger-api:9090

Both answer from anywhere in the cluster right now.

Task

Security has flagged node-02, which is scheduled to be re-imaged. Until that happens, no Pod running on it may reach the ledger API. Everything else in the cluster carries on unaffected, billing-worker included.

Create a NetworkPolicy named ledger-api-allowlist in the ledger namespace that:

• Selects every Pod in the ledger namespace, so all of them are protected by it.
• Admits TCP 8080 from Pods across the cluster, with the single exception of Pods running on node-02, including any created there later.
• Admits nothing else: TCP 9090 stays unreachable, and no second source is added.

The cluster hands out Pod addresses at start-up and the allocation is not stable between plays, so work out the values this cluster is actually using instead of assuming them.

kubectl explain networkpolicy.spec.ingress.from

kubectl explain networkpolicy.spec.ingress.from.ipBlock

kubectl get nodes -o custom-columns='NODE:.metadata.name,PODCIDR:.spec.podCIDR'

spec:
  podSelector: <scope: every Pod in the namespace>
  policyTypes:
  - <direction being controlled>
  ingress:
  - from:
    - <source type>:
        <field>: <range to admit>
        <field>:
        - <range to remove from it>
    ports:
    - protocol: <...>
      port: <...>

⚒ Test Cases

Understanding the challenge

The namespace starts with no NetworkPolicy, so every Pod in the cluster reaches both ports. Three things have to be true when you are done:

• The policy covers every Pod in ledger, not just the API.
• Port 8080 is admitted from anywhere in the cluster except workloads on node-02.
• Port 9090 is admitted from nowhere.

The rule has to follow a node, and no numbers are given, so the first job is finding out what addresses node-02 actually hands out.

The concept

A NetworkPolicy ingress rule has two independent parts, and traffic has to clear both:

• from lists the admitted sources. Each list entry is a separate rule, and a source passes if it matches any one of them.
• ports lists the admitted ports on the Pods the policy protects.

from offers three source types. podSelector and namespaceSelector match by label, which is the usual choice for in-cluster traffic, but neither can express this requirement: a Pod does not carry the identity of its node as a label, and a new Pod scheduled to node-02 tomorrow would carry whatever labels its author chose.

What every Pod on a node does share is its address. The scheduler gives each node a slice of the cluster Pod network, and kubelet allocates Pod addresses out of that slice. So "every Pod on node-02" is precisely "every address in node-02's Pod range", now and for any Pod created there later. That makes ipBlock the only workable source type, and it is also the only one with an except field, which is what removes a slice from an admitted range.

Two field-level details do the rest:

• podSelector: {} on the policy means every Pod in the namespace. A missing or non-empty selector narrows the scope.
• An omitted ports list admits every port, not none. Port numbers refer to the target Pods, not to the Service.

Steps

1. Read the address ranges off the nodes

kubectl get nodes -o custom-columns='NODE:.metadata.name,PODCIDR:.spec.podCIDR'

NODE        PODCIDR
cplane-01   10.42.0.0/24
node-01     10.42.1.0/24
node-02     10.42.3.0/24

Each node holds a /24, and all of them sit inside one /16, which is the cluster Pod network. The values above are from one play. Yours will differ, and the allocation is not even ordered, so node-02 is whichever range that command prints next to it.

Cross-check against where the Pods actually landed:

kubectl get pods -n ledger -o wide

NAME                          READY   STATUS    RESTARTS   AGE   IP          NODE
billing-worker                1/1     Running   0          7s    10.42.0.2   cplane-01
ledger-api-6b49c58bff-r9ttr   1/1     Running   0          7s    10.42.1.2   node-01
stale-worker                  1/1     Running   0          7s    10.42.3.2   node-02

stale-worker sits inside node-02's range, which is the range to remove.

2. Check the field reference

kubectl explain networkpolicy.spec.ingress.from.ipBlock

FIELDS:
  cidr  <string> -required-
    cidr is a string representing the IPBlock Valid examples are
    "192.168.1.0/24" or "2001:db8::/64"

  except    <[]string>
    except is a slice of CIDRs that should not be included within an IPBlock
    Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be
    rejected if they are outside the cidr range

Note the last sentence: an except entry has to sit inside the cidr it is carving out of, which is why the admitted range is the /16 rather than a list of the individual node /24s.

3. Write the policy

Both ranges come from step 1. The values shown here are from one play, not from yours.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ledger-api-allowlist
  namespace: ledger              # a policy only ever affects Pods in its own namespace
spec:
  podSelector: {}                # empty selector: every Pod in ledger is protected
  policyTypes:
  - Ingress                      # only incoming traffic is controlled, egress stays open
  ingress:
  - from:                        # one source rule, so this is the only admitted source
    - ipBlock:                   # selects by address, the only type that can follow a node
        cidr: <cluster Pod network>   # the /16 all node ranges sit inside
        except:
        - <node-02 Pod range>         # the /24 from step 1, removed from the line above
    ports:                       # without this list every port would be admitted
    - protocol: TCP
      port: 8080                 # port on the API Pods, not the Service port

4. Apply it

kubectl apply -f /home/laborant/ledger-api-allowlist.yaml

networkpolicy.networking.k8s.io/ledger-api-allowlist created

5. Check the healthy caller

kubectl -n ledger exec billing-worker -- curl -s -o /dev/null -w '%{http_code}\n' --max-time 5 http://ledger-api:8080

200

The admin port is now closed to the same Pod. Curl exits 7 because the connection is rejected rather than dropped, so the check returns immediately instead of waiting out the timeout:

kubectl -n ledger exec billing-worker -- curl -s -o /dev/null -w '%{http_code}\n' --max-time 5 http://ledger-api:9090

000
command terminated with exit code 7

6. Check the flagged node

kubectl -n ledger exec stale-worker -- curl -s -o /dev/null -w '%{http_code}\n' --max-time 5 http://ledger-api:8080

000
command terminated with exit code 7

stale-worker is inside the admitted /16 and would pass on cidr alone. It is refused only because node-02's range appears under except.

7. Review the final object

kubectl describe networkpolicy ledger-api-allowlist -n ledger

Name:         ledger-api-allowlist
Namespace:    ledger
Created on:   2026-09-11 18:42:14 +0000 UTC
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    To Port: 8080/TCP
    From:
      IPBlock:
        CIDR: 10.42.0.0/16
        Except: 10.42.3.0/24
  Not affecting egress traffic
  Policy Types: Ingress

Common mistakes

• Listing the other nodes' /24 ranges as separate ipBlock entries instead of admitting the /16 and carving out one slice. Traffic ends up correct today, but a fourth node added tomorrow would be refused, and the task asks for a single source.
• Selecting billing-worker by label. The outcome looks right for these two Pods, and any Pod on node-02 carrying that label would walk straight through.
• Narrowing podSelector to app: ledger-api. The task asks for every Pod in the namespace.
• Omitting ports, which leaves the admin endpoint on 9090 open.