Network Policies

Nantian Gateway creates Kubernetes NetworkPolicies by default to restrict ingress traffic to its pods. Only permitted traffic reaches the control plane, data plane, and dashboard components.

NetworkPolicies are enabled by default. You can disable them if your cluster already enforces policies at a different layer, or if you’re running in an environment without a NetworkPolicy controller.

Enabling and disabling

Toggle NetworkPolicies with a single value:

networkPolicies:
  enabled: true

Setting enabled: false removes all NetworkPolicy resources. The chart won’t render them on install or upgrade.

Which components get NetworkPolicies

The chart creates policies for three components:

Component	Template	What it protects
Control plane	templates/controlplane/networkpolicy.yaml	gRPC port (18080), admin API (18081), metrics (18082)
Data plane	templates/dataplane/networkpolicy.yaml	Admin API and metrics (19080), data plane health probes
Dashboard	templates/dashboard/networkpolicy.yaml	Dashboard web UI (3000)

Each policy follows the same pattern: it allows ingress from pods within the gateway’s namespace, plus any namespaces listed in serviceMonitor.fromNamespaces for the metrics port.

Allowed traffic

Control plane

The control plane NetworkPolicy permits:

• Port 18080 (gRPC): traffic from the same namespace, so data plane pods can connect to receive xDS snapshots
• Port 18081 (admin): traffic from the same namespace for the admin API
• Port 18082 (metrics): traffic from the same namespace, plus namespaces in serviceMonitor.fromNamespaces for Prometheus scraping
• Port 18083 (health): unrestricted access (0.0.0.0/0 and ::/0) so Kubernetes readiness and liveness probes always work

Data plane

The data plane NetworkPolicy permits:

• Port 19080 (admin/metrics): traffic from the same namespace for the admin API, plus namespaces in serviceMonitor.fromNamespaces for Prometheus scraping

Dashboard

The dashboard NetworkPolicy permits:

• Port 3000 (web UI): traffic from the same namespace

Adding custom rules

The chart’s NetworkPolicy templates cover the standard ports. If you need additional ingress rules, for example to allow a specific external IP to reach the control plane admin API, apply a separate NetworkPolicy resource:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nantian-gw-controlplane-custom
  namespace: nantian-gw
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: controlplane
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/8
      ports:
        - protocol: TCP
          port: 18081

Multiple NetworkPolicies targeting the same pods are additive, so your custom rules merge with the chart’s defaults.

CNI-specific considerations

NetworkPolicy enforcement depends on your cluster’s CNI plugin. Most managed Kubernetes services (EKS, AKS, GKE) include a compatible controller by default. For self-managed clusters:

CNI	NetworkPolicy Support	Notes
Calico	Full support	Default in many distributions. Supports both standard and Calico-specific policies.
Cilium	Full support	Supports standard NetworkPolicies plus CiliumNetworkPolicy for L7 rules.
Flannel	No native support	Requires Calico or Cilium as an additional policy engine.
Weave	Full support	Supports standard NetworkPolicies.

Verify your CNI supports NetworkPolicy by checking for a running controller:

kubectl get pods -n kube-system | grep -E "calico|cilium|weave"

If no policy controller is running, NetworkPolicies are created but not enforced — traffic flows unrestricted.

Troubleshooting

Pods cannot reach the control plane

If data plane pods fail to connect to the control plane gRPC port:

# Check the NetworkPolicy is applied
kubectl get networkpolicy -n nantian-gw

# Verify the data plane pod has the correct label
kubectl get pod -n nantian-gw -l app.kubernetes.io/component=dataplane --show-labels

# Test connectivity from within the data plane pod
kubectl exec -n nantian-gw deploy/nantian-gw-dataplane -- \
  nc -zv nantian-gw-controlplane 18080

If the NetworkPolicy is present but connectivity fails, verify the pod labels match the policy’s podSelector and namespaceSelector.

Prometheus cannot scrape metrics

When Prometheus runs in a different namespace, confirm serviceMonitor.fromNamespaces includes that namespace:

helm get values nantian-gw -n nantian-gw | grep -A5 serviceMonitor

Then verify the NetworkPolicy has an ingress rule for the Prometheus namespace:

kubectl describe networkpolicy nantian-gw-controlplane -n nantian-gw

Egress policies

The default NetworkPolicies only restrict ingress. To restrict egress traffic from gateway pods (e.g., to allow only specific external backends), add a custom egress NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nantian-gw-controlplane-egress
  namespace: nantian-gw
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: controlplane
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: TCP
          port: 443
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
      ports:
        - protocol: TCP
          port: 443

This allows the control plane to reach any pod in the cluster on port 443 and any external IP on port 443, while blocking cloud metadata endpoints.