Policy does not restrict ingress sources Affecting Network Policy service in Kubernetes
Severity Framework
Snyk CCSS
Rule category
Containers / Best Practices
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-Controls
- Snyk ID SNYK-CC-00627
- credit Snyk Research Team
Description
This can expose the sensitive endpoints to the wider range of threat actors.
How to fix?
Add ingress
rules which only allow access to specific services, or from limited sources.
Example Configuration
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-ingress-rule-multi
spec:
podSelector:
matchLabels:
app: web
ingress:
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
policyTypes:
- Ingress