---
title: "Integrating Network Policy with Helm for Enhanced Kubernetes Security"
source: "https://support.tools/integrating-network-policy-with-helm-for-enhanced-kubernetes-security/"
published: 2025-02-16
categories: ["Kubernetes","DevOps","Security"]
tags: ["Kubernetes","DevOps","Cloud","Security","Helm","NetworkPolicy"]
---


Learn how to enhance your Kubernetes cluster security by implementing Network Policies through Helm charts, including best practices and real-world examples.

## Understanding Network Policies in Kubernetes

Network Policies are Kubernetes resources that control the flow of network traffic between pods, namespaces, and external endpoints. They act as a firewall, allowing you to:

- Isolate workloads
- Enforce zero-trust networking
- Implement microsegmentation
- Control ingress and egress traffic
- Define allowed communication paths

## Why Use Helm for Network Policies?

Helm provides several advantages when managing Network Policies:

1. Templating capabilities for dynamic policy generation
2. Version control and rollback support
3. Consistent policy deployment across environments
4. Easy updates and modifications
5. Reusable policy templates

## Prerequisites

Before implementing Network Policies with Helm, ensure:

1. Your cluster supports Network Policies (e.g., using Calico, Cilium, or other CNI with NetworkPolicy support)
2. Helm 3.x is installed
3. Proper RBAC permissions are configured

## Basic Network Policy Template

Here's a basic example of a Network Policy template in a Helm chart:

```yaml
# templates/network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-policy
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: {{ .Values.appName }}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: {{ .Values.allowedNamespace }}
        - podSelector:
            matchLabels:
              role: {{ .Values.allowedRole }}
      ports:
        - protocol: TCP
          port: {{ .Values.servicePort }}
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: kube-system
      ports:
        - protocol: UDP
          port: 53 # DNS
```

## Implementing Common Security Patterns

### 1. Default Deny All Traffic

```yaml
# templates/default-deny.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-default-deny
  namespace: {{ .Release.Namespace }}
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
```

### 2. Allow Specific Microservices Communication

```yaml
# templates/microservice-policy.yaml
{{- range .Values.microservices }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ $.Release.Name }}-{{ .name }}-policy
spec:
  podSelector:
    matchLabels:
      app: {{ .name }}
  ingress:
    {{- range .allowedServices }}
    - from:
      - podSelector:
          matchLabels:
            app: {{ . }}
    {{- end }}
{{- end }}
```

### 3. Monitoring System Access

```yaml
# templates/monitoring-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-monitoring
spec:
  podSelector:
    matchLabels:
      app: {{ .Values.appName }}
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            name: monitoring
      ports:
        - port: {{ .Values.metricsPort }}
          protocol: TCP
```

## Values File Configuration

```yaml
# values.yaml
appName: myapp
servicePort: 8080
metricsPort: 9090
allowedNamespace: frontend
allowedRole: api

microservices:
  - name: frontend
    allowedServices:
      - backend
      - cache
  - name: backend
    allowedServices:
      - database
      - cache
  - name: database
    allowedServices: []
```

## Best Practices

### 1. Layer Your Policies

Create multiple policies that build upon each other:

```yaml
# templates/layered-policy.yaml
{{- if .Values.security.layers.basic }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-basic
spec:
  podSelector: {}
  policyTypes:
    - Ingress
---
{{- end }}
{{- if .Values.security.layers.advanced }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-advanced
spec:
  # Additional restrictions
{{- end }}
```

### 2. Use Conditional Policies

```yaml
# templates/conditional-policy.yaml
{{- if .Values.environment.production }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-strict-policy
spec:
  # Stricter rules for production
{{- else }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-dev-policy
spec:
  # More permissive rules for development
{{- end }}
```

### 3. Template Helper Functions

```yaml
# templates/_helpers.tpl
{{- define "networkpolicy.common.labels" -}}
app: {{ .Values.appName }}
environment: {{ .Values.environment.name }}
managed-by: {{ .Release.Service }}
{{- end }}
```

## Testing and Validation

1. Dry Run Installation:
```bash
helm install --dry-run --debug my-policies ./network-policies
```

2. Policy Validation:
```bash
kubectl auth can-i create networkpolicy
kubectl auth can-i update networkpolicy
```

3. Testing Connectivity:
```bash
# Test pod connectivity
kubectl run test-pod --image=busybox -n test-namespace -- wget -O- http://service-name:port
```

## Troubleshooting

Common issues and solutions:

1. **Policy Not Applied**
   - Check CNI plugin supports Network Policies
   - Verify label selectors match pods
   - Check policy is in correct namespace

2. **Unexpected Blocking**
   - Review egress rules for DNS access
   - Check namespace labels
   - Verify port specifications

3. **Policy Conflicts**
   - Network Policies are additive
   - More specific policies take precedence
   - Review all policies in namespace

## Monitoring and Logging

Enable policy monitoring:

```yaml
# templates/policy-metrics.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    metrics-enabled: "true"
    policy-log-level: "info"
```

## Conclusion

Integrating Network Policies with Helm provides a powerful way to manage and enforce network security in Kubernetes clusters. Key takeaways:

- Use templates for consistent policy deployment
- Layer policies for defense in depth
- Implement environment-specific policies
- Regular testing and validation
- Monitor policy effectiveness

Remember to:
- Start with restrictive policies
- Test thoroughly before production
- Document policy intentions
- Monitor policy impacts
- Regularly review and update policies

For more information, refer to the [Kubernetes Network Policy documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) and [Helm documentation](https://helm.sh/docs/).