1<!doctype html> 2<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-use-cases docs-doc-id-microsegmentation" data-has-hydrated="false"> 3<head> 4<meta charset="UTF-8"> 5<meta name="generator" content="Docusaurus v2.4.3"> 6<title data-rh="true">Implement microsegmentation with calico for enhanced Kubernetes Security | Calico Documentation</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://docs.tigera.io/use-cases/microsegmentation"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-use-cases-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-use-cases-current"><meta data-rh="true" property="og:title" content="Implement microsegmentation with calico for enhanced Kubernetes Security | Calico Documentation"><meta data-rh="true" name="description" content="Calico enables robust microsegmentation in Kubernetes environments, offering granular isolation and enhanced security for containerized applications."><meta data-rh="true" property="og:description" content="Calico enables robust microsegmentation in Kubernetes environments, offering granular isolation and enhanced security for containerized applications."><meta data-rh="true" name="keywords" content="microsegmentation"><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="canonical" href="https://docs.tigera.io/use-cases/microsegmentation"><link data-rh="true" rel="alternate" href="https://docs.tigera.io/use-cases/microsegmentation" hreflang="en"><link data-rh="true" rel="alternate" href="https://docs.tigera.io/use-cases/microsegmentation" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://Q4GSZWRKBA-dsn.algolia.net" crossorigin="anonymous">
6<script data-rh="true" src="https://widget.clym-sdk.net/blocking.js"></script>
6<script data-rh="true">!function(e,c,t,n,l){var a,m=e.getElementsByTagName("script")[0];e.getElementById(t)||((a=e.createElement("script")).id=t,a.src="https://widget.clym-sdk.net/clym.js",a.onload=function(){Clym&&Clym.load(t,"91ec4c5ce86a4d7abc26c44cn0osl70w",l)},m.parentNode.insertBefore(a,m))}(document,0,"clym-privacy",0,{})</script>
6<link rel="preconnect" href="https://www.googletagmanager.com">
7<script>window.dataLayer=window.dataLayer||[]</script>
vendor: 1 bytes, line 7
7
8<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-KCHDXB2",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
8 9 10 11<link rel="search" type="application/opensearchdescription+xml" title="Calico Documentation" href="/opensearch.xml"> 12 13 14
15<script src="https://widget.kapa.ai/kapa-widget.bundle.js" data-website-id="578b0d26-ff67-42e3-b465-5839865a7471" data-project-name="Calico" data-project-color="#F89C1D" data-project-logo="https://www.tigera.io/app/uploads/2021/06/Tigera-orange.png" data-modal-disclaimer="The Calico Docs AI answers questions based on what it finds in our product documentation. As with all AI solutions, it's a good idea to verify answers in the source material. " data-modal-ask-ai-input-placeholder="Ask me a question about Calico" data-font-family="Poppins,Helvetica Neue,Helvetica,Arial,sans-serif" data-modal-border-radius="6px" data-button-box-shadow="2px 2px 8px rgba(0, 0, 0, 0.2)" data-modal-header-bg-color="#FFFFFF" data-user-analytics-fingerprint-enabled="true" async></script>
15<link rel="stylesheet" href="/assets/css/styles.0612e5ac.css"> 16<link rel="preload" href="/assets/js/runtime~main.b74e6862.js" as="script"> 17<link rel="preload" href="/assets/js/main.bf7da04d.js" as="script"> 18</head> 19<body class="navigation-with-keyboard">
vendor: 68 bytes, lines 19-20
19 20<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=
20GTM-KCHDXB2
vendor: 84 bytes, lines 20-21
20" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> 21
22<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}return t}()||function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}(),document.documentElement.setAttribute("data-announcement-bar-initially-dismissed",function(){try{return"true"===localStorage.getItem("docusaurus.announcement.dismiss")}catch(t){}return!1}())</script>
22<div id="__docusaurus"> 23<style data-emotion="css-global c4d625">:host,:root,[data-theme]{--chakra-ring-inset:var(--chakra-empty,/*!*/ /*!*/);--chakra-ring-offset-width:0px;--chakra-ring-offset-color:#fff;--chakra-ring-color:rgba(66, 153, 225, 0.6);--chakra-ring-offset-shadow:0 0 #0000;--chakra-ring-shadow:0 0 #0000;--chakra-space-x-reverse:0;--chakra-space-y-reverse:0;--chakra-colors-transparent:transparent;--chakra-colors-current:currentColor;--chakra-colors-black:#000000;--chakra-colors-white:#FFFFFF;--chakra-colors-whiteAlpha-50:rgba(255, 255, 255, 0.04);--chakra-colors-whiteAlpha-100:rgba(255, 255, 255, 0.06);--chakra-colors-whiteAlpha-200:rgba(255, 255, 255, 0.08);--chakra-colors-whiteAlpha-300:rgba(255, 255, 255, 0.16);--chakra-colors-whiteAlpha-400:rgba(255, 255, 255, 0.24);--chakra-colors-whiteAlpha-500:rgba(255, 255, 255, 0.36);--chakra-colors-whiteAlpha-600:rgba(255, 255, 255, 0.48);--chakra-colors-whiteAlpha-700:rgba(255, 255, 255, 0.64);--chakra-colors-whiteAlpha-800:rgba(255, 255, 255, 0.80);--chakra-colors-whiteAlpha-900:rgba(255, 255, 255, 0.92);--chakra-colors-blackAlpha-50:rgba(0, 0, 0, 0.04);--chakra-colors-blackAlpha-100:rgba(0, 0, 0, 0.06);--chakra-colors-blackAlpha-200:rgba(0, 0, 0, 0.08);--chakra-colors-blackAlpha-300:rgba(0, 0, 0, 0.16);--chakra-colors-blackAlpha-400:rgba(0, 0, 0, 0.24);--chakra-colors-blackAlpha-500:rgba(0, 0, 0, 0.36);--chakra-colors-blackAlpha-600:rgba(0, 0, 0, 0.48);--chakra-colors-blackAlpha-700:rgba(0, 0, 0, 0.64);--chakra-colors-blackAlpha-800:rgba(0, 0, 0, 0.80);--chakra-colors-blackAlpha-900:rgba(0, 0, 0, 0.92);--chakra-colors-gray-50:#F7FAFC;--chakra-colors-gray-100:#EDF2F7;--chakra-colors-gray-200:#E2E8F0;--chakra-colors-gray-300:#CBD5E0;--chakra-colors-gray-400:#A0AEC0;--chakra-colors-gray-500:#718096;--chakra-colors-gray-600:#4A5568;--chakra-colors-gray-700:#2D3748;--chakra-colors-gray-800:#1A202C;--chakra-colors-gray-900:#171923;--chakra-colors-red-50:#FFF5F5;--chakra-colors-red-100:#FED7D7;--chakra-colors-red-200:#FEB2B2;--chakra-colors-red-300:#FC8181;--chakra-colors-red-400:#F56565;--chakra-colors-red-500:#E53E3E;--chakra-colors-red-600:#C53030;--chakra-colors-red-700:#9B2C2C;--chakra-colors-red-800:#822727;--chakra-colors-red-900:#63171B;--chakra-colors-orange-50:#FFFAF0;--chakra-colors-orange-100:#FEEBC8;--chakra-colors-orange-200:#FBD38D;--chakra-colors-orange-300:#F6AD55;--chakra-colors-orange-400:#ED8936;--chakra-colors-orange-500:#DD6B20;--chakra-colors-orange-600:#C05621;--chakra-colors-orange-700:#9C4221;--chakra-colors-orange-800:#7B341E;--chakra-colors-orange-900:#652B19;--chakra-colors-yellow-50:#FFFFF0;--chakra-colors-yellow-100:#FEFCBF;--chakra-colors-yellow-200:#FAF089;--chakra-colors-yellow-300:#F6E05E;--chakra-colors-yellow-400:#ECC94B;--chakra-colors-yellow-500:#D69E2E;--chakra-colors-yellow-600:#B7791F;--chakra-colors-yellow-700:#975A16;--chakra-colors-yellow-800:#744210;--chakra-colors-yellow-900:#5F370E;--chakra-colors-green-50:#F0FFF4;--chakra-colors-green-100:#C6F6D5;--chakra-colors-green-200:#9AE6B4;--chakra-colors-green-300:#68D391;
23--chakra-colors-green-400:#48BB78;--chakra-colors-green-500:#38A169;--chakra-colors-green-600:#2F855A;--chakra-colors-green-700:#276749;--chakra-colors-green-800:#22543D;--chakra-colors-green-900:#1C4532;--chakra-colors-teal-50:#E6FFFA;--chakra-colors-teal-100:#B2F5EA;--chakra-colors-teal-200:#81E6D9;--chakra-colors-teal-300:#4FD1C5;--chakra-colors-teal-400:#38B2AC;--chakra-colors-teal-500:#319795;--chakra-colors-teal-600:#2C7A7B;--chakra-colors-teal-700:#285E61;--chakra-colors-teal-800:#234E52;--chakra-colors-teal-900:#1D4044;--chakra-colors-blue-50:#ebf8ff;--chakra-colors-blue-100:#bee3f8;--chakra-colors-blue-200:#90cdf4;--chakra-colors-blue-300:#63b3ed;--chakra-colors-blue-400:#4299e1;--chakra-colors-blue-500:#3182ce;--chakra-colors-blue-600:#2b6cb0;--chakra-colors-blue-700:#2c5282;--chakra-colors-blue-800:#2a4365;--chakra-colors-blue-900:#1A365D;--chakra-colors-cyan-50:#EDFDFD;--chakra-colors-cyan-100:#C4F1F9;--chakra-colors-cyan-200:#9DECF9;--chakra-colors-cyan-300:#76E4F7;--chakra-colors-cyan-400:#0BC5EA;--chakra-colors-cyan-500:#00B5D8;--chakra-colors-cyan-600:#00A3C4;--chakra-colors-cyan-700:#0987A0;--chakra-colors-cyan-800:#086F83;--chakra-colors-cyan-900:#065666;--chakra-colors-purple-50:#FAF5FF;--chakra-colors-purple-100:#E9D8FD;--chakra-colors-purple-200:#D6BCFA;--chakra-colors-purple-300:#B794F4;--chakra-colors-purple-400:#9F7AEA;--chakra-colors-purple-500:#805AD5;--chakra-colors-purple-600:#6B46C1;--chakra-colors-purple-700:#553C9A;--chakra-colors-purple-800:#44337A;--chakra-colors-purple-900:#322659;--chakra-colors-pink-50:#FFF5F7;--chakra-colors-pink-100:#FED7E2;--chakra-colors-pink-200:#FBB6CE;--chakra-colors-pink-300:#F687B3;--chakra-colors-pink-400:#ED64A6;--chakra-colors-pink-500:#D53F8C;--chakra-colors-pink-600:#B83280;--chakra-colors-pink-700:#97266D;--chakra-colors-pink-800:#702459;--chakra-colors-pink-900:#521B41;--chakra-colors-linkedin-50:#E8F4F9;--chakra-colors-linkedin-100:#CFEDFB;--chakra-colors-linkedin-200:#9BDAF3;--chakra-colors-linkedin-300:#68C7EC;--chakra-colors-linkedin-400:#34B3E4;--chakra-colors-linkedin-500:#00A0DC;--chakra-colors-linkedin-600:#008CC9;--chakra-colors-linkedin-700:#0077B5;--chakra-colors-linkedin-800:#005E93;--chakra-colors-linkedin-900:#004471;--chakra-colors-facebook-50:#E8F4F9;--chakra-colors-facebook-100:#D9DEE9;--chakra-colors-facebook-200:#B7C2DA;--chakra-colors-facebook-300:#6482C0;--chakra-colors-facebook-400:#4267B2;--chakra-colors-facebook-500:#385898;--chakra-colors-facebook-600:#314E89;--chakra-colors-facebook-700:#29487D;--chakra-colors-facebook-800:#223B67;--chakra-colors-facebook-900:#1E355B;--chakra-colors-messenger-50:#D0E6FF;--chakra-colors-messenger-100:#B9DAFF;--chakra-colors-messenger-200:#A2CDFF;--chakra-colors-messenger-300:#7AB8FF;--chakra-colors-messenger-400:#2E90FF;--chakra-colors-messenger-500:#0078FF;--chakra-colors-messenger-600:#0063D1;--chakra-colors-messenger-700:#0052AC;--chakra-colors-messenger-800:#003C7E;--chakra-colors-messenger-900:#002C5C;--chakra-colors-whatsapp-50:#dffeec;--chakra-colors-whatsapp-100:#b9f5d0;--chakra-colors-whatsapp-200:#90edb3;--chakra-colors-whatsapp-300:#65e495;--chakra-colors-whatsapp-400:#3cdd78;--chakra-colors-whatsapp-500:#22c35e;--chakra-colors-whatsapp-600:#179848;--chakra-colors-whatsapp-700:#0c6c33;--chakra-colors-whatsapp-800:#01421c;--chakra-colors-whatsapp-900:#001803;--chakra-colors-twitter-50:#E5F4FD;--chakra-colors-twitter-100:#C8E9FB;--chakra-colors-twitter-200:#A8DCFA;--chakra-colors-twitter-300:#83CDF7;--chakra-colors-twitter-400:#57BBF5;--chakra-colors-twitter-500:#1DA1F2;--chakra-colors-twitter-600:#1A94DA;--chakra-colors-twitter-700:#1681BF;--chakra-colors-twitter-800:#136B9E;--chakra-colors-twitter-900:#0D4D71;--chakra-colors-telegram-50:#E3F2F9;--chakra-colors-telegram-100:#C5E4F3;--chakra-colors-telegram-200:#A2D4EC;--chakra-colors-telegram-300:#7AC1E4;--chakra-colors-telegram-400:#47A9DA;--chakra-colors-telegram-500:#0088CC;--chakra-colors-telegram-600:#007AB8;--chakra-colors-telegram-700:#006BA1;--chakra-colors-telegram-800:#005885;--chakra-colors-telegram-900:#003F5E;--chakra-colors-tigeraGrey-50:#F5F5F5;--chakra-colors-tigeraGrey-100:#F5F5F5;--chakra-colors-tigeraGrey-200:#DCDDE0;--chakra-colors-tigeraGrey-300:#DCDDE0;--chakra-colors-tigeraGrey-400:#B0B2B8;--chakra-colors-tigeraGrey-500:#B0B2B8;--chakra-colors-tigeraGrey-600:#5F5F5F;--chakra-colors-tigeraGrey-700:#5F5F5F;--chakra-colors-tigeraGrey-800:#424346;--chakra-colors-tigeraGrey-900:#424346;--chakra-colors-tigeraGreen-50:#CCF4E3;--chakra-colors-tigeraGreen-100:#CCF4E3;--chakra-colors-tigeraGreen-200:#99E9C6;--chakra-colors-tigeraGreen-300:#99E9C6;
23--chakra-colors-tigeraGreen-400:#66DDAA;--chakra-colors-tigeraGreen-500:#66DDAA;--chakra-colors-tigeraGreen-600:#33D28D;--chakra-colors-tigeraGreen-700:#33D28D;--chakra-colors-tigeraGreen-800:#00C771;--chakra-colors-tigeraGreen-900:#00C771;--chakra-colors-tigeraRed-50:#FCD9D8;--chakra-colors-tigeraRed-100:#FCD9D8;--chakra-colors-tigeraRed-200:#F9B3B2;--chakra-colors-tigeraRed-300:#F9B3B2;--chakra-colors-tigeraRed-400:#F78C8B;--chakra-colors-tigeraRed-500:#F78C8B;--chakra-colors-tigeraRed-600:#F46665;--chakra-colors-tigeraRed-700:#F46665;--chakra-colors-tigeraRed-800:#F1403E;--chakra-colors-tigeraRed-900:#F1403E;--chakra-colors-tigeraBlueLight:#DCEAF3;--chakra-colors-tigeraBlueMedium40:#097DB6;--chakra-colors-tigeraBlueMedium:#1084BD;--chakra-colors-tigeraBlueDark:#273981;--chakra-colors-tigeraGoldLight:#FCE181;--chakra-colors-tigeraGoldMedium40:#FBD4A6;--chakra-colors-tigeraGoldMedium:#F69320;--chakra-colors-tigeraGoldDark:#F37828;--chakra-colors-tigeraPeach:#FF7455;--chakra-colors-tigeraRose:#FF5EAB;--chakra-colors-tigeraLilac:#7E70FF;--chakra-colors-tigeraSky:#58CDFF;--chakra-colors-tigeraCoast:#21CFC2;--chakra-colors-tigeraZest:#BEE846;--chakra-colors-tigeraBlack:#141414;--chakra-colors-tigeraWhite:#FFFFFF;--chakra-colors-tigeraDarkBlue:#273981;--chakra-colors-tigeraCloudGrey:#E6EAF0;--chakra-borders-none:0;--chakra-borders-1px:1px solid;--chakra-borders-2px:2px solid;--chakra-borders-4px:4px solid;--chakra-borders-8px:8px solid;--chakra-fonts-heading:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--chakra-fonts-body:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--chakra-fonts-mono:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;--chakra-fontSizes-3xs:0.45rem;--chakra-fontSizes-2xs:0.625rem;--chakra-fontSizes-xs:0.75rem;--chakra-fontSizes-sm:0.875rem;--chakra-fontSizes-md:1rem;--chakra-fontSizes-lg:1.125rem;--chakra-fontSizes-xl:1.25rem;--chakra-fontSizes-2xl:1.5rem;--chakra-fontSizes-3xl:1.875rem;--chakra-fontSizes-4xl:2.25rem;--chakra-fontSizes-5xl:3rem;--chakra-fontSizes-6xl:3.75rem;--chakra-fontSizes-7xl:4.5rem;--chakra-fontSizes-8xl:6rem;--chakra-fontSizes-9xl:8rem;--chakra-fontSizes-xxs:0.625rem;--chakra-fontWeights-hairline:100;--chakra-fontWeights-thin:200;--chakra-fontWeights-light:300;--chakra-fontWeights-normal:400;--chakra-fontWeights-medium:500;--chakra-fontWeights-semibold:600;--chakra-fontWeights-bold:700;--chakra-fontWeights-extrabold:800;--chakra-fontWeights-black:900;--chakra-letterSpacings-tighter:-0.05em;--chakra-letterSpacings-tight:-0.025em;--chakra-letterSpacings-normal:0;--chakra-letterSpacings-wide:0.025em;--chakra-letterSpacings-wider:0.05em;--chakra-letterSpacings-widest:0.1em;--chakra-lineHeights-3:.75rem;--chakra-lineHeights-4:1rem;--chakra-lineHeights-5:1.25rem;--chakra-lineHeights-6:1.5rem;--chakra-lineHeights-7:1.75rem;--chakra-lineHeights-8:2rem;--chakra-lineHeights-9:2.25rem;--chakra-lineHeights-10:2.5rem;--chakra-lineHeights-normal:normal;--chakra-lineHeights-none:1;--chakra-lineHeights-shorter:1.25;--chakra-lineHeights-short:1.375;--chakra-lineHeights-base:1.5;--chakra-lineHeights-tall:1.625;--chakra-lineHeights-taller:2;--chakra-radii-none:0;--chakra-radii-sm:0.125rem;--chakra-radii-base:0.25rem;--chakra-radii-md:0.375rem;--chakra-radii-lg:0.5rem;--chakra-radii-xl:0.75rem;--chakra-radii-2xl:1rem;--chakra-radii-3xl:1.5rem;--chakra-radii-full:9999px;--chakra-space-1:0.25rem;--chakra-space-2:0.5rem;--chakra-space-3:0.75rem;--chakra-space-4:1rem;--chakra-space-5:1.25rem;--chakra-space-6:1.5rem;--chakra-space-7:1.75rem;--chakra-space-8:2rem;--chakra-space-9:2.25rem;--chakra-space-10:2.5rem;--chakra-space-12:3rem;--chakra-space-14:3.5rem;--chakra-space-16:4rem;--chakra-space-20:5rem;--chakra-space-24:6rem;--chakra-space-28:7rem;--chakra-space-32:8rem;--chakra-space-36:9rem;--chakra-space-40:10rem;--chakra-space-44:11rem;--chakra-space-48:12rem;--chakra-space-52:13rem;--chakra-space-56:14rem;--chakra-space-60:15rem;--chakra-space-64:16rem;--chakra-space-72:18rem;--chakra-space-80:20rem;--chakra-space-96:24rem;--chakra-space-px:1px;--chakra-space-0-5:0.125rem;--chakra-space-1-5:0.375rem;--chakra-space-2-5:0.625rem;--chakra-space-3-5:0.875rem;--chakra-shadows-xs:0 0 0 1px rgba(0, 0, 0, 0.05);--chakra-shadows-sm:0 1px 2px 0 rgba(0, 0, 0, 0.05);--chakra-shadows-base:0 1px 3px 0 rgba(0, 0, 0, 0.1),0 1px 2px 0 rgba(0, 0, 0, 0.06);--chakra-shadows-md:0 4px 6px -1px rgba(0, 0, 0, 0.1),0 2px 4px -1px rgba(0, 0, 0, 0.06);--chakra-shadows-lg:0 10px 15px -3px rgba(0, 0, 0, 0.1),0 4px 6px -2px rgba(0, 0, 0, 0.05);--chakra-shadows-xl:0 20px 25px -5px rgba(0, 0, 0, 0.1),0 10px 10px -5px rgba(0, 0, 0, 0.04);--chakra-shadows-2xl:0 25px 50px -12px rgba(0, 0, 0, 0.25);--chakra-shadows-outline:0 0 0 3px rgba(66, 153, 225, 0.6);--chakra-shadows-inner:inset 0 2px 4px 0 rgba(0,0,0,0.06);--chakra-shadows-none:none;--chakra-shadows-dark-lg:rgba(0, 0, 0, 0.1) 0px 0px 0px 1px,rgba(0, 0, 0, 0.2) 0px 5px 10px,rgba(0, 0, 0, 0.4) 0px 15px 40px;--chakra-sizes-1:0.25rem;--chakra-sizes-2:0.5rem;--chakra-sizes-3:0.75rem;--chakra-sizes-4:1rem;--chakra-sizes-5:1.25rem;--chakra-sizes-6:1.5rem;--chakra-sizes-7:1.75rem;--chakra-sizes-8:2rem;--chakra-sizes-9:2.25rem;--chakra-sizes-10:2.5rem;--chakra-sizes-12:3rem;--chakra-sizes-14:3.5rem;--chakra-sizes-16:4rem;--chakra-sizes-20:5rem;--chakra-sizes-24:6rem;--chakra-sizes-28:7rem;--chakra-sizes-32:8rem;--chakra-sizes-36:9rem;--chakra-sizes-40:10rem;--chakra-sizes-44:11rem;--chakra-sizes-48:12rem;--chakra-sizes-52:13rem;--chakra-sizes-56:14rem;--chakra-sizes-60:15rem;--chakra-sizes-64:16rem;--chakra-sizes-72:18rem;--chakra-sizes-80:20rem;--chakra-sizes-96:24rem;--chakra-sizes-100:25rem;--chakra-sizes-px:1px;--chakra-sizes-0-5:0.125rem;--chakra-sizes-1-5:0.375rem;--chakra-sizes-2-5:0.625rem;--chakra-sizes-3-5:0.875rem;--chakra-sizes-max:max-content;
23--chakra-sizes-min:min-content;--chakra-sizes-full:100%;--chakra-sizes-3xs:14rem;--chakra-sizes-2xs:16rem;--chakra-sizes-xs:20rem;--chakra-sizes-sm:24rem;--chakra-sizes-md:28rem;--chakra-sizes-lg:32rem;--chakra-sizes-xl:36rem;--chakra-sizes-2xl:42rem;--chakra-sizes-3xl:48rem;--chakra-sizes-4xl:56rem;--chakra-sizes-5xl:64rem;--chakra-sizes-6xl:72rem;--chakra-sizes-7xl:80rem;--chakra-sizes-8xl:90rem;--chakra-sizes-prose:60ch;--chakra-sizes-container-sm:640px;--chakra-sizes-container-md:768px;--chakra-sizes-container-lg:1024px;--chakra-sizes-container-xl:1280px;--chakra-zIndices-hide:-1;--chakra-zIndices-auto:auto;--chakra-zIndices-base:0;--chakra-zIndices-docked:10;--chakra-zIndices-dropdown:1000;--chakra-zIndices-sticky:1100;--chakra-zIndices-banner:1200;--chakra-zIndices-overlay:1300;--chakra-zIndices-modal:1400;--chakra-zIndices-popover:1500;--chakra-zIndices-skipLink:1600;--chakra-zIndices-toast:1700;--chakra-zIndices-tooltip:1800;--chakra-transition-property-common:background-color,border-color,color,fill,stroke,opacity,box-shadow,transform;--chakra-transition-property-colors:background-color,border-color,color,fill,stroke;--chakra-transition-property-dimensions:width,height;--chakra-transition-property-position:left,right,top,bottom;--chakra-transition-property-background:background-color,background-image,background-position;--chakra-transition-easing-ease-in:cubic-bezier(0.4, 0, 1, 1);--chakra-transition-easing-ease-out:cubic-bezier(0, 0, 0.2, 1);--chakra-transition-easing-ease-in-out:cubic-bezier(0.4, 0, 0.2, 1);--chakra-transition-duration-ultra-fast:50ms;--chakra-transition-duration-faster:100ms;--chakra-transition-duration-fast:150ms;--chakra-transition-duration-normal:200ms;--chakra-transition-duration-slow:300ms;--chakra-transition-duration-slower:400ms;--chakra-transition-duration-ultra-slow:500ms;--chakra-blur-none:0;--chakra-blur-sm:4px;--chakra-blur-base:8px;--chakra-blur-md:12px;--chakra-blur-lg:16px;--chakra-blur-xl:24px;--chakra-blur-2xl:40px;--chakra-blur-3xl:64px;--chakra-breakpoints-base:0em;--chakra-breakpoints-sm:30em;
23--chakra-breakpoints-md:48em;--chakra-breakpoints-lg:62em;--chakra-breakpoints-xl:80em;--chakra-breakpoints-2xl:96em;}.chakra-ui-light :host:not([data-theme]),.chakra-ui-light :root:not([data-theme]),.chakra-ui-light [data-theme]:not([data-theme]),[data-theme=light] :host:not([data-theme]),[data-theme=light] :root:not([data-theme]),[data-theme=light] [data-theme]:not([data-theme]),:host[data-theme=light],:root[data-theme=light],[data-theme][data-theme=light]{--chakra-colors-chakra-body-text:var(--chakra-colors-gray-800);--chakra-colors-chakra-body-bg:var(--chakra-colors-white);--chakra-colors-chakra-border-color:var(--chakra-colors-gray-200);--chakra-colors-chakra-inverse-text:var(--chakra-colors-white);--chakra-colors-chakra-subtle-bg:var(--chakra-colors-gray-100);--chakra-colors-chakra-subtle-text:var(--chakra-colors-gray-600);--chakra-colors-chakra-placeholder-color:var(--chakra-colors-gray-500);}.chakra-ui-dark :host:not([data-theme]),.chakra-ui-dark :root:not([data-theme]),.chakra-ui-dark [data-theme]:not([data-theme]),[data-theme=dark] :host:not([data-theme]),[data-theme=dark] :root:not([data-theme]),[data-theme=dark] [data-theme]:not([data-theme]),:host[data-theme=dark],:root[data-theme=dark],[data-theme][data-theme=dark]{--chakra-colors-chakra-body-text:var(--chakra-colors-whiteAlpha-900);--chakra-colors-chakra-body-bg:var(--chakra-colors-gray-800);--chakra-colors-chakra-border-color:var(--chakra-colors-whiteAlpha-300);--chakra-colors-chakra-inverse-text:var(--chakra-colors-gray-800);--chakra-colors-chakra-subtle-bg:var(--chakra-colors-gray-700);--chakra-colors-chakra-subtle-text:var(--chakra-colors-gray-400);--chakra-colors-chakra-placeholder-color:var(--chakra-colors-whiteAlpha-400);}</style><style data-emotion="css-global 7vw66x">:root,:host{--chakra-vh:100vh;}@supports (height: -webkit-fill-available){:root,:host{--chakra-vh:-webkit-fill-available;}}@supports (height: -moz-fill-available){:root,:host{--chakra-vh:-moz-fill-available;}}@supports (height: 100dvh){:root,:host{--chakra-vh:100dvh;}}</style><style data-emotion="css-global d3bs39">body{font-family:var(--chakra-fonts-body);color:var(--chakra-colors-chakra-body-text);background:var(--chakra-colors-chakra-body-bg);transition-property:background-color;transition-duration:var(--chakra-transition-duration-normal);line-height:var(--chakra-lineHeights-base);}*::-webkit-input-placeholder{color:var(--chakra-colors-chakra-placeholder-color);}*::-moz-placeholder{color:var(--chakra-colors-chakra-placeholder-color);}*:-ms-input-placeholder{color:var(--chakra-colors-chakra-placeholder-color);}*::placeholder{color:var(--chakra-colors-chakra-placeholder-color);}*,*::before,::after{border-color:var(--chakra-colors-chakra-border-color);}html,body{font-family:"Poppins","Helvetica Neue","Helvetica","Arial",sans-serif;}img{vertical-align:unset;}</style><div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><div class="announcementBar_mb4j" style="background-color:#FCE181;color:#000" role="banner"><div class="content_knG7 announcementBarContent_xLdY">Documentation archive for Calico Enterprise 3.14. This version is no longer maintained. For the latest documentation, go to <a href="https://docs.tigera.io">https://docs.tigera.io</a>.</div></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link logo-wrapper"><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/tigera-logo-black.png" alt="Calico Documentation" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/tigera-logo-white.png" alt="Calico Documentation" class="themedImage_ToTc themedImage--dark_i4oU"></div></a></a><ul class="dropdown__menu"><li><a href="https://www.tigera.io/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Tigera home</a></li><li><a href="https://www.tigera.io/project-calico/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Project Calico</a></li><li><a href="https://www.tigera.io/tigera-products/compare-products/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Compare products</a></li><li><a href="https://www.tigera.io/tigera-products/calico-cloud-pricing/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Pricing</a></li><li><a href="https://www.tigera.io/blog/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Blog</a></li><li><a href="https://www.tigera.io/events/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Events</a></li><li><a href="https://www.tigera.io/contact/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Contact us</a></li></ul></div><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link documentation-dropdown">Documentation</a><ul class="dropdown__menu"><li><a class="dropdown__link navbar-product-link_calico" href="/calico/3.26/about/">Calico Open Source</a></li></ul></div><a href="https://www.tigera.io/tutorials/" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Tutorials</a><a href="https://www.tigera.io/lp/calico-certification/" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Certification</a><a href="https://www.calicocloud.io/home" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Try Calico Cloud</a><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">Use cases</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/use-cases/microsegmentation">Microsegmentation</a></li><li><a class="dropdown__link" href="/use-cases/observability">Observability</a></li><li><a class="dropdown__link" href="/use-cases/egress-access-controls">Egress access controls</a></li><li><a class="dropdown__link" href="/use-cases/egress-gateways">Egress gateways</a></li><li><a class="dropdown__link" href="/use-cases/cluster-mesh">Cluster mesh</a></li></ul></div></div><div class="navbar__items navbar__items--right"><a href="https://github.com/projectcalico" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link header-icon-link github-icon" aria-label="GitHub repository"></a><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type="button" disabled="" title="Switch between dark and light mode (currently light mode)" aria-label="Switch between dark and light mode (currently light mode)" aria-l
23ive="polite"><svg viewBox="0 0 24 24" width="24" height="24" class="lightToggleIcon_pyhR"><path fill="currentColor" d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" class="darkToggleIcon_wfgR"><path fill="currentColor" d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"></path></svg></button></div><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG menuWithAnnouncementBar_GW3s"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--active">Use cases</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/use-cases/microsegmentation">Microsegmentation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/use-cases/observability">Observability</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/use-cases/egress-access-controls">Egress access controls</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/use-cases/egress-gateways">Egress gateways</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/use-cases/cluster-mesh">Cluster mesh</a></li></ul></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_z5aJ">
23<div class="docItemContainer_c0TR"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Use cases</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Microsegmentation</span><meta itemprop="position" content="2"></li></ul></nav><div class="theme-doc-markdown markdown"><h1>Microsegmentation</h1><p>This guide explains the concept of microsegmentation and shows you how to use Calico network policy to isolate and protect containerized applications.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="overview">Overview<a href="#overview" class="hash-link" aria-label="Direct link to Overview" title="Direct link to Overview">â</a></h2><h3 class="anchor anchorWithStickyNavbar_LWe7" id="what-is-microsegmentation">What is microsegmentation?<a href="#what-is-microsegmentation" class="hash-link" aria-label="Direct link to What is microsegmentation?" title="Direct link to What is microsegmentation?">â</a></h3><p>Microsegmentation extends traditional segmentation to containerized environments, providing granular isolation for enhanced security in Kubernetes. 24Unlike legacy methods that focus on perimeter security, microsegmentation leverages network policies to secure assets at a finer level, from workloads to namespaces, based on label selectors. 25By limiting communication between segments, it isolates critical security domains, stops lateral movement, and ensures compliance.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="why-use-calico-for-microsegmentation">Why use Calico for microsegmentation?<a href="#why-use-calico-for-microsegmentation" class="hash-link" aria-label="Direct link to Why use Calico for microsegmentation?" title="Direct link to Why use Calico for microsegmentation?">â</a></h3><p>Anyone who has a need to segment containerized systems in their organization can use <a href="/calico/latest/network-policy/get-started/calico-policy/calico-network-policy">Calico's network policies</a> to isolate, protect, and secure multiple security domains, such as Kubernetes workloads, namespaces, tenants, and hosts. 26Traditional firewalls are not designed with dynamic, containerized environments in mind. 27Instead, microsegmentation is implemented using purpose-built network policies that allow for different levels of granularity to secure workloads, applications, namespaces, or clusters.</p><p>Calico has a range of functionality that makes implementing microsegmentation in Kubernetes easier and faster.</p><p>In open-source Calico (Project Calico) and commercial Calico products, you take advantage of Calico network policy, which extends functionality of Kubernetes network policy. Some of these key features include using Calico network policies to protect more endpoints, write global policies that apply cluster-wide, and additional policy actions such as deny and log.</p><p>Commercial Calico products (Calico Enterprise and Calico Cloud) compliment the additional network policy capabilities with an easy-to-use browser-based UI that includes observability, enhanced policy management, policy recommendations, and more.</p><p>More detailed descriptions of functionality and how to implement microsegmentation with Calico can be found further on in this document.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="microsegmentation-at-different-levels">Microsegmentation at different levels<a href="#microsegmentation-at-different-levels" class="hash-l
27ink" aria-label="Direct link to Microsegmentation at different levels" title="Direct link to Microsegmentation at different levels">â</a></h3><p>When organizations need to segment and isolate their Kubernetes environments, this is typically done at three different levels: <a href="https://www.tigera.io/blog/enabling-microsegmentation-with-calico-enterprise-2/" target="_blank" rel="noopener noreferrer">Workload Isolation</a>, <a href="https://www.tigera.io/blog/automated-namespace-isolation-with-calico/" target="_blank" rel="noopener noreferrer">Namespace Isolation</a> and <a href="https://www.tigera.io/blog/deep-dive/implementing-tenant-isolation-in-multi-tenant-kubernetes-clusters/" target="_blank" rel="noopener noreferrer">Tenant Isolation</a>.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="workload-isolation">Workload isolation<a href="#workload-isolation" class="hash-link" aria-label="Direct link to Workload isolation" title="Direct link to Workload isolation">â</a></h4><p>Kubernetes network policy is defined to secure specific microservices within a tenant or namespace. 28Isolating individual workloads helps further reduce the attack surface and prevents lateral movement between workloads or potential performance issues. 29A network policy designed for workload isolation contains more restrictive ingress and egress rules, only allowing essential communication between microservices. 30For example, an application may contain frontend and backend workloads within the same namespace. 31If the frontend is public, and more likely to be breached, apply a microsegmentation strategy where communication between the frontend and backend is restricted. 32If the frontend is compromised, the likelihood of the malicious actor obtaining sensitive information from the backend is significantly reduced. 33Perimeter (namespace) security approaches are inadequate in this situation.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="namespace-isolation">Namespace isolation<a href="#namespace-isolation" class="hash-link" aria-label="Direct link to Namespace isolation" title="Direct link to Namespace isolation">â</a></h4><p>In Kubernetes, namespaces are used to separate different software applications or processes from each other by assigning them unique namespaces. 34This helps to prevent conflicts or interference between different applications that may be running on the same system, and owned by different users. 35Isolating and securing applications in their namespaces means developers can ensure that their software operates independently and securely without the ability to impact other namespaces in the cluster. 36If one application in a namespace is compromised, having secured and isolated namespaces reduces and contains the âblast radiusâ of that threat.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="tenant-isolation">Tenant isolation<a href="#tenant-isolation" class="hash-link" aria-label="Direct link to Tenant isolation" title="Direct link to Tenant isolation">â</a></h4><p>When cluster infrastructure is shared between tenants, there may be an organizational or compliance requirement for isolation. 37A tenant may contain several resources, including workloads or namespaces (secured or unsecured), and still require that perimeter security apply to the context of the tenant. 38This protects each tenant from lateral movement at an infrastructure level where a malicious or opportunistic actor may seek to obtain or steal high value assets, damage or misuse applications. 39If one tenant is compromised, the risk to other tenants on the same infrastru
39cture is significantly reduced.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="foundational-concepts-for-microsegmentation">Foundational concepts for microsegmentation<a href="#foundational-concepts-for-microsegmentation" class="hash-link" aria-label="Direct link to Foundational concepts for microsegmentation" title="Direct link to Foundational concepts for microsegmentation">â</a></h2><p>Before implementing a segmentation strategy in a cluster there are a few key high-level concepts that must be understood. 40These are:</p><ul><li>Security domains</li><li>Network security</li><li>Default deny</li></ul><p>If you are a Calico Enterprise or Calico Cloud user there are more features available that enable a faster and easier microsegmentation experience.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="security-domains">Security domains<a href="#security-domains" class="hash-link" aria-label="Direct link to Security domains" title="Direct link to Security domains">â</a></h3><p>Anyone implementing microsegmentation and zero-trust should first identify all the security domains that need to be secured, which is what you need to secure. 41A security domain could be any of the following:</p><p><em>Clusters</em>: The cluster can be considered a security domain.</p><p><em>Tenants</em>: Each tenant can be considered a separate security domain. 42A tenant may be comprised of a team or individuals that share the same Kubernetes infrastructure. 43It is a collection of applications or namespaces for which a specific security declaration is enforced.</p><p><em>Namespaces</em>: Microservices that make up an application are typically organized into a single namespace and can be treated as separate security domains. 44For example, you can consider protecting an application from other applications in the cluster or the same tenant.</p><p><em>Endpoints</em> A microservice comprises endpoint groups such as Deployment, StatefulSet, and DaemonSet resources. 45Microservices, even in the same namespace, must be protected from each other to limit exposure if one is compromised. 46For example, consider a frontend and a backend microservice in the same namespace. 47They are in separate security domains and must be protected by network policies.</p><p><img loading="lazy" alt="Security domains" src="/assets/images/security-domains-cf88b974bcea28c57bd45a8a2fb8650d.png" width="3612" height="2292" class="img_ev3q"></p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="calicos-enhanced-network-policy-capabilities">Calico's enhanced network policy capabilities<a href="#calicos-enhanced-network-policy-capabilities" class="hash-link" aria-label="Direct link to Calico's enhanced network policy capabilities" title="Direct link to Calico's enhanced network policy capabilities">â</a></h3><p>Successful segmentation is achieved by implementing network policies that secure security domains at the correct granularity depending on an organization's security posture or compliance requirements.</p><p>Calicoâs network policies provide a richer set of policy capabilities than standard Kubernetes network policies. 48Calico's network policies include:</p><ul><li>policy ordering/priority</li><li>deny rules</li><li>more flexible match rules</li><li>applicable to multiple endpoints (pods, VMs, and host interfaces).</li></ul><p>There is a more detailed list of Calico network policy features available <a href="/calico/latest/network-policy/get-started/calico-policy/calico-network-policy#features">here</a>. 49The Kubernetes documentation outlines what network policies <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" target="_blank" rel="noopener noreferrer">do</a> and <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#what-you-can-t-do-with-network-policies-at-least-not-yet" target="_blank" rel="noopener noreferrer">do not</a> support.</p><p>Project Calico integration with Istio providers application security, and service mesh. 50This integration enables layers 5â7 network policy match criteria, end-to-e
50nd mTLS encryption, and cryptographic identity. 51For more information, read <a href="https://www.tigera.io/blog/how-to-build-a-service-mesh-with-istio-and-calico/" target="_blank" rel="noopener noreferrer">this blog</a> to learn how to integrate Kubernetes RBAC and Calico to achieve shift-left security.</p><p>Calico network policies are:</p><ul><li><em>Declarative</em> - define security intentions in YAML files (or by creating a policy from the Calico Cloud or Calico Enterprise Manager UI)</li><li><em>Label-based</em> - network policies apply to endpoints based on workload identity using label selectors. 52These can be combined into larger expressions using multiple operators and parentheses.</li><li><em>Dynamic</em> - network policies are tightly coupled with workloads based on their identity, not ever-changing IP addresses</li></ul><p><img loading="lazy" alt="Network policy anatomy" src="/assets/images/anatomy-of-policy-82b38fe7e1e404d54458315214ef8182.png" width="4484" height="2204" class="img_ev3q"></p><p>All Calico products support label-based policies that can be applied to either a namespace or cluster-wide (global) scope.</p><p>By default, if no policies exist, then all ingress and egress traffic is allowed to and from pods in that namespace.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="default-deny">Default deny<a href="#default-deny" class="hash-link" aria-label="Direct link to Default deny" title="Direct link to Default deny">â</a></h3><p>In Kubernetes, the default allows all traffic, unless policies apply to it. 53Therefore, we recommend creating a <a href="/calico/latest/network-policy/get-started/kubernetes-default-deny">default deny</a> policy for your Kubernetes pods. 54This guarantees that if no other policy is defined that explicitly allows traffic to/from a pod, then the traffic will be denied.</p><p>Note that an implicit default deny policy always occurs last. 55If any other policy allows the traffic, then the deny does not come into effect. 56The deny is executed only after all other policies are evaluated.</p><p>A global default deny policy avoids needing to define a policy every time a namespace is created. 57It also forces tenants of the cluster to define a network policy for every new pod. 58However, ensure you have the correct allow policies in place to ensure control plane traffic does not get blocked.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="additional-functionality-with-calico-enterprise-and-calico-cloud">Additional functionality with Calico Enterprise and Calico Cloud<a href="#additional-functionality-with-calico-enterprise-and-calico-cloud" class="hash-link" aria-label="Direct link to Additional functionality with Calico Enterprise and Calico Cloud" title="Direct link to Additional functionality with Calico Enterprise and Calico Cloud">â</a></h3><p>Calico Enterprise and Calico Cloud extend network policy capabilities and usability to support hierarchical tiered network policy, automatic network policy recommendations (including automatic namespace isolation) based on existing flows, and integrations with third party firewalls. 59Network policies can be viewed and managed through a user interface, with the ability to stage and preview policy impact before enforcement.</p><p>To achieve something similar to tiers, Project Calico users may want to read this <a href="https://www.tigera.io/blog/how-to-integrate-kubernetes-rbac-and-calico-to-achieve-shift-left-security/" target="_blank" rel="noopener noreferrer">blog</a>.</p><p>This enables users to manage policies at scale, leading to more efficient management and implementation of a microsegmentation strategy.</p><p>The diagram below shows an example of how policies for different security domains are grouped and organized into tiers with Calico Cloud or Enterprise.</p><p><img loading="lazy" alt="Tiers" src="/assets/images/security-policy-framework-02239e8357a746558fb2d107e080778c.png" width="6248" height="3808" class="img_ev3q"></p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="global-network-policies">Global network policies<a href="#global-network-policies" class="hash-l
59ink" aria-label="Direct link to Global network policies" title="Direct link to Global network policies">â</a></h4><p>Calico supports global network policy <code>kind: GlobalNetworkPolicy</code>; a non-namespaced resource containing rules which are applied to any endpoints (pods, VMs, host interfaces) that match a selector. 60Network policy is a namespaced resource that only applies to workload endpoint resources (pods, containers, VMs) within that namespace. 61Global policies are beneficial in reducing the number of policies that need to be written and managed by targeting assets that span across a cluster or multiple namespaces. An example of this might be creating one default deny policy instead or one policy that allows communication to system services, like kube-dns. The alternative would be using Kubernetes network policies and duplicating policies for each namespace within the cluster.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="network-policy-management">Network policy management<a href="#network-policy-management" class="hash-link" aria-label="Direct link to Network policy management" title="Direct link to Network policy management">â</a></h4><p>Network policy can quickly become complex and hard to manage. 62There are a number of tools that make it easier to understand what your policies are doing and help you make adjustments.</p><h5 class="anchor anchorWithStickyNavbar_LWe7" id="policy-ordering">Policy ordering<a href="#policy-ordering" class="hash-link" aria-label="Direct link to Policy ordering" title="Direct link to Policy ordering">â</a></h5><p>In Calico, you can use the order field (with precedence from the lowest value to highest) to control how policies are applied and evaluated. 63Defining policy order is important when you include both <code>action: allow</code> and <code>action: deny</code> rules that may apply to the same endpoint.</p><p>In Calico, you can use the order field (with precedence from the lowest value to highest) to control how policies are applied and evaluated. 64Defining policy order is important when you include both <code>action: allow</code> and <code>action: deny</code> rules that apply to the same endpoint.</p><p>If no network policies apply to a pod, then all traffic to that pod is allowed.</p><p>If one or more network policies apply to a pod containing ingress rules, then only the ingress traffic specifically allowed by those policies is allowed.</p><p>If one or more network policies apply to a pod containing egress rules, then only the egress traffic specifically allowed by those policies is allowed.</p><h5 class="anchor anchorWithStickyNavbar_LWe7" id="policy-tiers">Policy tiers<a href="#policy-tiers" class="hash-link" aria-label="Direct link to Policy tiers" title="Direct link to Policy tiers">â</a></h5><p>Calico Cloud and Calico Enterprise allow hierarchical grouping of policies into tiers. 65Policy tiers allow enforcement of higher-precedence policies that cannot be circumvented by other teams. 66Policy tiers are evaluated based on order, as are policies within each tier. 67Graphically, policies are evaluated from left to right, top to bottom. 68RBAC for each tier can be defined to restrict who can interact with each tier.</p><p>While Calico Open Source does not support policy tiers, you can use RBAC to control how different users can shape cluster security.</p><h5 class="anchor anchorWithStickyNavbar_LWe7" id="staged-policies">Staged policies<a href="#staged-policies" class="hash-link" aria-label="Direct link to Staged policies" title="Direct link to Staged policies">â</a></h5><p>These rules are used to preview network behavior and do not enforce network traffic, and can be applied to both network or global policies.</p><p>Staged policies let you test the traffic impact of the policy as if it were enforced, but without changing traffic flow. 69You can also preview the impacts of a staged policy on existing traffic. 70By verifying that correct flows are allowed and denied before enforcement, you can minimize misconfiguration and potential network disruption.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="implementing-microsegmentation-with-network-policies">Implementing microsegmentation with network policies<a href="#implementing-microsegmentation-with-network-policies" class="hash-l
70ink" aria-label="Direct link to Implementing microsegmentation with network policies" title="Direct link to Implementing microsegmentation with network policies">â</a></h2><p>To implement microsegmentation, you should follow a structured and repeatable approach to increase the likelihood of success. 71These can be summarized as four broad steps:</p><ol><li><p><a href="/use-cases/microsegmentation#identify-your-security-domains">Identify the security domains</a> for which microsegmentation will be enforced, who will be responsible for them, and who or which services need access to those security domains.</p></li><li><p><a href="/use-cases/microsegmentation#develop-a-policy-framework">Define a policy</a> model using documented microservice communication for your applications or by analyzing traffic flows. 72When defining policies you should also consider the scope of the policies (global or namespace), who will be writing and applying the policies, and policy order (or tiers).</p></li><li><p><a href="/use-cases/microsegmentation#deploy-network-policies">Author and deploy network policies</a>. 73Once all the correct allow policies are in place, stage a <a href="/use-cases/microsegmentation#enforce-a-default-deny-policy">default deny policy</a>. 74You may want to identify a low-impact application or security domain first to understand and evaluate the process before prioritizing segmentation of critical security domains.</p></li><li><p><a href="/use-cases/microsegmentation#monitor-and-fine-tune-your-policies">Re-assess any flows</a> or new applications that may require policy remediation before enforcing a default-deny. 75In Calico Open Source, where staged policies are not supported, enforce a default deny in a staging environment to correct any policies prior to enforcing in production.</p></li></ol><h3 class="anchor anchorWithStickyNavbar_LWe7" id="identify-your-security-domains">Identify your security domains<a href="#identify-your-security-domains" class="hash-link" aria-label="Direct link to Identify your security domains" title="Direct link to Identify your security domains">â</a></h3><p>When identifying security domains or applications to secure, you may also want to consider compliance requirements and how critical your applications are. 76For more information on meeting compliance requirements beyond microsegmentation, review one of our <a href="https://www.tigera.io/resources/?_sft_types=white-paper&_sft_Resource_Topics=compliance" target="_blank" rel="noopener noreferrer">white papers</a>. 77This will be unique to your organizational requirements, security posture, and risk tolerance.</p><p>An organization should know if they have critical applications that require a strong security posture, where the effort to protect outweighs the risk of having an application compromised. 78This will require a more fine-grained security approach and might need policies in place for multiple security domains: cluster, tenants, namespaces, and workloads. 79In a low-risk environment that doesn't contain critical or sensitive data, you may determine that namespace or tenant security domain isolation is sufficient.</p><p>Starting with a low-risk implementation in a staging environment allows you to de-risk the process before applying it to business-critical security domains.</p><p>Things you should consider:</p><ul><li>Compliance requirements</li><li>Vulnerability or susceptibility to attack</li><li>Organizational security posture (zero-trust will require more stringent segmentation)</li><li>Importance of applications or security domains</li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="develop-a-policy-framework">Develop a policy framework<a href="#develop-a-policy-framework" class="hash-link" aria-label="Direct link to Develop a policy framework" title="Direct link to Develop a policy framework">â</a></h3><p>Once the security domains are identified, you should start designing and developing your network policies. 80Work from the highest-level policies (broadest scope) to the lowest level, more fine-grained policies. 81In Calico Enterprise or Calico Cloud, it will be easier to think in tiers, and design policies tier-by-tier, from left to right across the policy board. 82The left-hand side of the board contains tiers and policies with higher precedence that apply to the cluster or platform, or a broad subset of assets within them. 83As you move right across the policy board, tiers should focus on specific namespaces or applications and the network policies will reflect that.</p><p>Refer to this diagram as a skeleton framework for developing a policy framework:</p><p><img loading="lazy" alt="Tiers" src="/assets/images/security-policy-framework-02239e8357a746558fb2d107e080778c.png" width="6248" height="3808" class="img_ev3q"></p><p>Before you can write the network policies, you will need to know how to target specific assets (labels, service accounts or namespaces) and what rules to write (based on cluster traffic):</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="analyze-cluster-traffic">Analyze cluster traffic<a href="#analyze-cluster-traffic" class="hash-l
83ink" aria-label="Direct link to Analyze cluster traffic" title="Direct link to Analyze cluster traffic">â</a></h4><p>To define a network policy model, you need to know what the expected communication is within a security domain and design policies to protect those domains. 84You may need to consider:</p><ul><li><a href="/calico-enterprise/latest/network-policy/policy-best-practices#use-global-network-policy-only-when-all-rules-apply-globally">Will you use global or namespaced policies?</a></li><li><a href="/calico-enterprise/latest/network-policy/hosts/">Do you need to protect hosts (and configure that)?</a></li><li><a href="/calico-enterprise/latest/network-policy/policy-best-practices#determine-who-can-write-policy">Who is responsible for defining policies for different security domains?</a></li><li><a href="/calico-enterprise/latest/network-policy/policy-tiers/policy-tutorial-ui#policy-ordering">What order should policies be applied in?</a></li><li>Policy <a href="/calico-enterprise/latest/network-policy/policy-tiers/policy-tutorial-ui#tiers">tiers</a>, for Calico Cloud or Calico Enterprise users.</li></ul><p>Policy models may be easier to produce if an application has documentation stating how microservices communicate over which protocols and ports. 85A âshift leftâ approach also puts the onus on individuals or developers who are more familiar with communication dependencies and can define accurate policy.</p><p>If youâre using Calico Open Source and struggling to analyze traffic flows, you may find it easier to install a text scraping tool (such as Fluent Bit) and pass log information to a text processing application (such as Elastic). 86This lets you see layer 2-3 logs and build policies based on that information.</p><p>Calico Cloud and Enterprise users have multiple tools available to analyze flows: 87<a href="/calico-cloud/tutorials/calico-cloud-features/tour#service-graph">Dynamic Service and Threat Graph</a> is a topographical visualization of workload communication. 88Through this feature, you can access flow logs that show metadata for source and destination endpoints, as well as any policies that apply to the flow and the outcome. 89<a href="/calico-cloud/tutorials/calico-cloud-features/tour#service-graph">Flow Visualization</a> shows volumetric flow data within the cluster in a 360â view. 90FlowViz, in addition to Service Graph, allows users to see what flows exist within a cluster or namespace, metadata and selectors associated with endpoints and any applied policies. 91<a href="/calico-cloud/tutorials/calico-cloud-features/tour#logs">Elasticsearch and Kibana</a> are included with <a href="/calico-enterprise/latest/visibility/kibana">Calico Cloud</a> and <a href="/calico-enterprise/latest/visibility/kibana">Calico Enterprise</a> that enables users to explore Elasticsearch logs and gain insights into workload communication traffic volume, performance, and other key aspects of cluster operations. 92Log data is also summarized in custom dashboards.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="label-your-assets">Label your assets<a href="#label-your-assets" class="hash-link" aria-label="Direct link to Label your assets" title="Direct link to Label your assets">â</a></h4><p>As network policies are identity-aware, it is likely assets within a cluster will be targeted using labels. 93Additionally, Calico global network policies can target service accounts or namespaces. 94As such, before authoring any policies, ensure all assets are appropriately labeled so that policy selectors can target the correct assets at the right level of segmentation.</p><p>In an example applying microsegmentation to a demo storefront, every pod within a hipstershop namespace is labeled with a compliance label in addition to an 'app' label denoting what service the pod is. 95This allows for multiple policies. One network policy could be designed, allowing communication between all pods with a generalized label. Other network policies could be created for each workload, using the 'app' label to target specific workloads and create fine-grained ingress and egress rules. 96This allows flexibility in the approach to microsegmentation depending on which security domains need protecting.</p><p>When designing and applying labels, you should:</p><ol><li>Integrate label design into the identification step, creating a hierarchical design that aligns with security domains.</li><li>Use label prefixes for classification to create a standardized approach depen
96ding on the security domain. 97Consider prefixing labels with the intended security domain, and designing appropriate key/value pairs that accurately represent the tenant, application, namespace, or endpoint.</li><li>Don't use reserved label keys, such as <code>kubernetes</code>, <code>tigera</code> or <code>calico</code>.</li><li>If using a CI/CD pipeline, ensure the right labels are being applied and set up label governance checks. 98This will ensure new deployments are appropriately secured from the beginning.</li></ol><p><a href="https://www.helpnetsecurity.com/2021/05/26/kubernetes-security/" target="_blank" rel="noopener noreferrer">More information is available on labeling best practices.</a></p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="write-your-policies">Write your policies<a href="#write-your-policies" class="hash-link" aria-label="Direct link to Write your policies" title="Direct link to Write your policies">â</a></h4><p>The previous steps should set you up for success when creating policies because you will know exactly what policies need to be created, with what order and tier, and what labels to use as selectors.</p><p>Before you write any policies, you may want to review the best practices for network policies in: <a href="/calico/latest/about/kubernetes-training/about-network-policy#best-practices-for-network-policies">Calico Open Source</a>, <a href="/calico-enterprise/latest/network-policy/policy-best-practices#policy-best-practices-for-day-one-zero-trust">Calico Enterprise</a>, <a href="/calico-cloud/tutorials/training/about-network-policy#best-practices-for-network-policies">Calico Cloud</a>.</p><p>To make policy writing easier and faster, Calico Enterprise and Calico Cloud have several features you may want to consider: 99Graphical Policy Editor: <a href="/calico-cloud/network-policy/policy-tiers/policy-tutorial-ui#create-a-network-policy">Calico Cloud</a> and <a href="/calico-enterprise/latest/network-policy/policy-tiers/policy-tutorial-ui#create-a-network-policy">Calico Enterprise</a> have a âCreate Policyâ GUI to create, edit, and delete policies. 100Policies that have been created in the GUI can be downloaded as YAML.</p><p>DNS Policies: <a href="/calico-enterprise/latest/network-policy/beginners/policy-rules/external-ips-policy">If you need to limit traffic to/from external non-Calico workloads or networks, you can use external IPs or network rules.</a></p><p>Automatic policy recommendations: Calico Cloud and Calico Enterprise also support <a href="/calico-enterprise/latest/network-policy/recommendations/policy-recommendations">automatic policy recommendations</a> that automatically generate network policy to isolate namespaces. 101Policy recommendations can also be generated for specific namespaces or workloads for a more granular segmentation strategy. 102Policy Recommendations makes it easier and faster for platform operators to implement namespace isolation at scale or without experience in authoring network policies or detailed knowledge of how application workloads are communicating. 103Calico analyzes the flow logs that are generated from workloads, and automatically recommends and stages policies for each namespace that can be used for isolation. 104All recommended polices are staged by default. 105This allows you to preview the impact of a policy without impacting traffic flow, to assess the effectiveness of a policy, or to evaluate any unintended side-effects. 106<a href="/calico-enterprise/latest/network-policy/recommendations/policy-recommendations#activate-and-review-policy-recommendations">Policy recommendations need to be enabled</a> per cluster and may take time to learn and analyze flows before providing recommendations.</p><p>All versions of Calico support both Kubernetes network policy and Calico network policy.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="deploy-network-policies">Deploy network policies<a href="#deploy-network-policies" class="hash-link" aria-label="Direct link to Deploy network policies" title="Direct link to Deploy network policies">â</a></h3><p>In all products, policies can be applied using the CLI. 107Policies created in the Calico Enterprise or Calico Cloud Manager UI can be staged or enforced through the UI. 108You can check whether policies have been applied by running the following commands:</p><div data-codeblock-validation="true"><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#393A34;--prism-background-color:#f6f8fa"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#393A34"><span class="token plain">kubectl get networkpolicy</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain">kubectl describe networkpolicy </span><span class="token operator" style="color:#393A34"><</span><span class="token plain">
108networkpolicy-name</span><span class="token operator" style="color:#393A34">></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><p>or</p><div data-codeblock-validation="true"><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#393A34;--prism-background-color:#f6f8fa"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#393A34"><span class="token plain">kubectl get globalnetworkpolicy</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain">kubectl describe globalnetworkpolicy </span><span class="token operator" style="color:#393A34"><</span><span class="token plain">globalnetworkpolicy-name</span><span class="token operator" style="color:#393A34">></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><p>When applying network policies, you will need to apply policies in such an order that it does not impact applications. 109Calico network policy supports policy ordering when traffic is being evaluated. 110Calico Enterprise and Calico Cloud also support hierarchical policy tiers.</p><p>With <a href="/calico/latest/network-policy/get-started/calico-policy/calico-network-policy#apply-network-policies-in-specific-order">Calico Open Source</a> you may want to define the policy order in the policy spec in addition to applying policies in the correct order.</p><p>Calico Enterprise and Calico Cloud feature hierarchical tiers that are visible on the policies board. 111Any applied policies, both staged and enforced, are visible on the policies board in the correct order.</p><p>It is important to understand how <a href="/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy#policy-endpoint-matching-across-tiers">policy endpoints match across tiers</a>.</p><ol><li>Apply policies by any method. 112Start with general policies that target broad security domains.</li><li>Verify policies are working as intended before you apply narrower policies, such as those at the application or workload level.</li><li>Ensure policies allow communication to critical services and control plane services (such as kube-dns).</li><li>Confirm that policies exist in the correct order by using CLI tools or the Manager UI's policy board.</li><li>Enforce any staged policies.</li></ol><h3 class="anchor anchorWithStickyNavbar_LWe7" id="enforce-a-default-deny-policy">Enforce a default deny policy<a href="#enforce-a-default-deny-policy" class="hash-link" aria-label="Direct link to Enforce a default deny policy" title="Direct link to Enforce a default deny policy">â</a></h3><p>The default behavior in Kubernetes is to allow all communication that isn't restricted by a network policy. 113A default deny policy ensures that unwanted traffic (ingress and egress) is denied by default. 114You must create policies to allow traffic to your pods and services. 115Pods without a policy (or that have an incorrect policy) are blocked from all network traffic until an appropriate network policy is defined.</p><p>Note that Calico global network policies are not namespaced. 116They affect all pods that match the policy selector. 117In contrast, Kubernetes network policies are namespaced 118To achieve the same effect, you would need to create a default deny policy for every namespace in your cluster.</p><p>This also comes with the warning that you need to ensure the default deny does not target system pods that are critical to cluster integrity. 119The following policy correctly excludes system pods from the global deny rule:</p><div data-codeblock-validation="true"><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#393A34;--prism-background-color:#f6f8fa"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#393A34"><span class="token key atrule" style="color:#00a4db">apiVersion</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> projectcalico.org/v3</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key atrule" style="color:#00a4db">kind</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> GlobalNetworkPolicy</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key atrule" style="color:#00a4db">metadata</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">name</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> deny</span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain">app</span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain">policy</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key atrule" style="color:#00a4db">spec</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">namespaceSelector</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> has(projectcalico.org/name) </span><span class="token important">&&</span><span class="token plain"> projectcalico.org/name not in </span><span class="token punctuation" style="color:#393A34">
119{</span><span class="token string" style="color:#e3116c">"kube-system"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"calico-system"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"tigera-system"</span><span class="token punctuation" style="color:#393A34">}</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">types</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain"> Ingress</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain"> Egress</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">egress</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># allow all namespaces to communicate to DNS pods</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">action</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> Allow</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">protocol</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> UDP</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">destination</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">selector</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">'k8s-app == "kube-dns"'</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">ports</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain"> </span><span class="token number" style="color:#36acaa">53</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">action</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> Allow</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">protocol</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> TCP</span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">destination</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">selector</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">'k8s-app == "kube-dns"'</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token key atrule" style="color:#00a4db">ports</span><span class="token punctuation" style="color:#393A34">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">-</span><span class="token plain"> </span><span class="token number" style="color:#36acaa">53</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N">
119<path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><p>Calico Enterprise and Calico Cloud have a 'hidden' tier that contains policies to secure Calico components that have precedence over any user-created policies or tiers. 120To ensure your cluster continues to work correctly, don't modify or circumvent these policies.</p><p><a href="/calico/latest/network-policy/get-started/kubernetes-default-deny">Calico Open Source: Enable default deny for Kubernetes pods</a></p><p>In Calico Cloud and Calico Enterprise the <a href="/calico-enterprise/latest/reference/resources/stagednetworkpolicy">staging policy</a> tool will help you find incorrect and missing policies 121A global deny rule helps mitigate other lateral malicious attacks.</p><p>We recommend that you create a global default deny policy after you complete writing policy for the traffic that you want to allow. 122Use the staged policy feature to get your allowed traffic working as expected, and then lock down the cluster to block unwanted traffic. 123The following steps summarize best practice:</p><ul><li>Create a staged global default deny policy. 124It will show all the traffic that would be blocked if it were converted into an enforced deny policy.</li><li>Create other network policies to individually allow the traffic shown as blocked, until no connections are denied.</li><li>Convert the staged global network policy to an enforced policy.</li></ul><p>Steps to an enforced default-deny posture:</p><ol><li>Create your allow policies. 125You can't predict everything, but try to get as much of this in place as you can.</li><li>Create a default deny policy. 126If globally scoped, create one policy. 127For namespace-scoped default deny policies, create one policy per namespace.<ul><li>In Calico Enterprise or Calico Cloud, stage the default deny policy either through the UI or by setting <code>kind: StagedGlobalNetworkPolicy</code> or <code>kind: StagedNetworkPolicy</code>.</li><li>In Calico Open Source, you should apply the default deny policy in a non-production environment first. 128You may optionally include a <a href="/calico/latest/reference/resources/networkpolicy#rule">'log' action</a> and have flows that are evaluated by the default deny recorded in the syslog.</li></ul></li><li>Simulate your application or services. 129Validate all policies are working as intended, and there are no issues with the application or service.</li><li>Once everything is validated, the default deny policy can be enforced or applied in a production environment.</li></ol><h3 class="anchor anchorWithStickyNavbar_LWe7" id="monitor-and-fine-tune-your-policies">Monitor and fine-tune your policies<a href="#monitor-and-fine-tune-your-policies" class="hash-link" aria-label="Direct link to Monitor and fine-tune your policies" title="Direct link to Monitor and fine-tune your policies">â</a></h3><p>After you have policies in place, you can actively monitor traffic and performance to make sure your policies are behaving as you expect.</p><p>There are a few ways to monitor and review whether your policies are effective.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="review-the-policies-board">Review the policies board<a href="#review-the-policies-board" class="hash-link" aria-label="Direct link to Review the policies board" title="Direct link to Review the policies board">â</a></h4><p>In Calico Cloud and Calico Enterprise, the policies board is the first place to look for misconfigurations. 130From here, you can spot policies that are denying traffic or that have no endpoints assigned to them.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="use-observability-tools">Use observability tools<a href="#use-observability-tools" class="hash-link" aria-label="Direct link to Use observability tools" title="Direct link to Use observability tools">â</a></h4><p>Calico Enterprise and Calico Cloud have tools that help you visually identify misconfigured policies 131These include Service Graph, FlowViz, and the policy board. 132Commercial Calico products also include Kibana as a frontend for ElasticSearch. 133This provides richer functionality for dashboards and logs. 134For an in-depth demonstration, see <a href="https://fast.wistia.com/embed/channel/lhjf79y3oy?wchannelid=lhjf79y3oy" target="_blank" rel="noopener noreferrer">this video series</a>.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="test-connectivity-with-test-pods">
134Test connectivity with test pods<a href="#test-connectivity-with-test-pods" class="hash-link" aria-label="Direct link to Test connectivity with test pods" title="Direct link to Test connectivity with test pods">â</a></h4><p>One way to test connectivity is to deploy test pods in different security domains and see whether they can connect to one another. 135You can label these pods to mimic other services and trigger specific policies. 136When the pods are deployed, you can use tools such as curl or netcat to check that connectivity is working as expected.</p><p>The response can be used to determine if a network policy is correctly denying or allowing traffic to pass through, and this can be used in conjunction with flow logs or observability.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="read-the-logs">Read the logs<a href="#read-the-logs" class="hash-link" aria-label="Direct link to Read the logs" title="Direct link to Read the logs">â</a></h4><p>Calico supports a log action for its network policies. 137Calico Enterprise and Calico Cloud can collect a wide range of logs that can be used to investigate flows and validate policies.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="simulate-your-application-or-service">Simulate your application or service<a href="#simulate-your-application-or-service" class="hash-link" aria-label="Direct link to Simulate your application or service" title="Direct link to Simulate your application or service">â</a></h4><p>Using and testing the deployed application and a wide range of its functionality should show whether there are any issues after deploying and enforcing network policies.</p><p>If you need to create new policies or edit existing policies, refer to the sections above.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/tigera/docs/edit/main/use-cases/microsegmentation.mdx" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--next" href="/use-cases/observability"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Observability</div></a></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="row footer__links"><div class="col footer__col"><div class="footer__title">Learn</div><ul class="footer__items clean-list"><li class="footer__item"><a class="footer__link-item" href="/">Documentation</a></li><li class="footer__item"><a href="https://www.tigera.io/events" target="_blank" rel="noopener noreferrer" class="footer__link-item">Events</a></li><li class="footer__item"><a href="https://www.tigera.io/resources" target="_blank" rel="noopener noreferrer" class="footer__link-item">Resource center</a></li><li class="footer__item"><a href="https://www.tigera.io/blog" target="_blank" rel="noopener noreferrer" class="footer__link-item">Blog</a></li><li class="footer__item"><a href="https://www.tigera.io/lp/tradeshows" target="_blank" rel="noopener noreferrer" class="footer__link-item">Trade shows</a></li><li class="footer__item"><a href="https://www.tigera.io/lp/calico-certification" target="_blank" rel="noopener noreferrer" class="footer__link-item">Certification</a></li><li class="footer__item"><a href="https://www.tigera.io/learn/guides/kubernetes-monitoring" target="_blank" rel="noopener noreferrer" class="footer__link-item">Guides</a></li></ul></div><div class="col footer__col"><div class="footer__title">Support</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://www.tigera.io/customer-success" target="_blank" rel="noopener noreferrer" class="footer__link-item">Customer success</a></li><li class="footer__item"><a href="https://tigera.force.com/community/s/login/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Support portal</a></li><li class="footer__item"><a href="https://www.tigera.io/security-bulletins" target="_blank" rel="noopener noreferrer" class="footer__link-item">Security bulletins</a></li><li class="footer__item"><a href="https://www.tigera.io/vulnerability-disclosure" target="_blank" rel="noopener noreferrer" class="footer__link-item">Report a security issue</a></li></ul></div>
137<div class="col footer__col"><div class="footer__title">Open source</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://www.tigera.io/project-calico" target="_blank" rel="noopener noreferrer" class="footer__link-item">Project Calico</a></li><li class="footer__item"><a href="https://www.tigera.io/project-calico/community" target="_blank" rel="noopener noreferrer" class="footer__link-item">Community</a></li><li class="footer__item"><a href="https://github.com/projectcalico" target="_blank" rel="noopener noreferrer" class="footer__link-item">GitHub</a></li><li class="footer__item"><a href="https://stackoverflow.com/questions/tagged/project-calico" target="_blank" rel="noopener noreferrer" class="footer__link-item">Stack Overflow</a></li><li class="footer__item"><a href="https://calicousers.slack.com/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Slack</a></li></ul></div><div class="col footer__col"><div class="footer__title">Company</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://www.tigera.io/about" target="_blank" rel="noopener noreferrer" class="footer__link-item">About</a></li><li class="footer__item"><a href="https://www.tigera.io/customer-stories" target="_blank" rel="noopener noreferrer" class="footer__link-item">Customers</a></li><li class="footer__item"><a href="https://www.tigera.io/partners" target="_blank" rel="noopener noreferrer" class="footer__link-item">Partners</a></li><li class="footer__item"><a href="https://www.tigera.io/media" target="_blank" rel="noopener noreferrer" class="footer__link-item">Newsroom</a></li><li class="footer__item"><a href="https://www.tigera.io/careers" target="_blank" rel="noopener noreferrer" class="footer__link-item">Careers</a></li><li class="footer__item"><a href="https://www.tigera.io/contact" target="_blank" rel="noopener noreferrer" class="footer__link-item">Contact</a></li></ul></div></div><div class="footer__bottom text--center"><div class="footer__copyright"> 138 <div> 139 <br> 140 <div class="footer-copyright__title">Copyright © 2024 Tigera, Inc.</div> 141 <div class="footer-copyright__description">Tigera is the creator and maintainer of Project Calico.</div> 142 <a href="#" onclick='Clym.showWidget("","",event)'>Privacy Center</a> | 143 <a href="#" onclick='Clym.showWidget("/requests/new/do_not_sell_my_information","",event)'>Do not sell or share my personal information</a> 144 <div> 145 <a href="https://www.linkedin.com/company/tigera/" target="_blank" rel="noopener noreferrer" class="footer-social-icon linkedin-icon" aria-label="Linkedin profile"></a> 146 <a href="https://twitter.com/tigeraio" target="_blank" rel="noopener noreferrer" class="footer-social-icon twitter-icon" aria-label="Twitter profile"></a> 147 <a href="https://www.youtube.com/channel/UC8uN3yhpeBeerGNwDiQbcgw" target="_blank" rel="noopener noreferrer" class="footer-social-icon youtube-icon" aria-label="YouTube channel"></a> 148 <a href="https://calicousers.slack.com/" target="_blank" rel="noopener noreferrer" class="footer-social-icon slack-icon" aria-label="Slack team"></a> 149 </div> 150 </div> 151 </div></div></div></footer><span></span><span id="__chakra_env" hidden=""></span></div>
152<script src="/assets/js/runtime~main.b74e6862.js"></script>
vendor: 1 bytes, line 152
152
153<script src="/assets/js/main.bf7da04d.js"></script>
153 154</body> 155</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.