Orchestration / K8S / Controls / DEV
Enforce Default-Deny Workload Network Policies
CCC.K8S.CN06 · Networking
Confine workload communication to flows permitted by explicit, least-privilege network policies, with all other traffic denied by default.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.K8S.CP07 | Cluster Network Integration | The service can attach cluster, node, pod, and service connectivity to a user-configured cloud virtual network. |
| CCC.K8S.CP09 | Workload Network Policy | The service may be configured with Kubernetes network policies that enforce ingress and egress boundaries between workloads and external systems. |
| CCC.K8S.CP08 | Workload Traffic Routing | The service can expose and route internal or external traffic to Kubernetes workloads through services, load balancers, ingress controllers, and gateway components. |
Related Threats
| ID | Title | Description |
|---|
| CCC.K8S.TH06 | Workload Network Segmentation is Not Enforced | Absent or ineffective ingress and egress policies may allow traffic to flow between namespaces, workloads, and external systems without an explicit authorization boundary. Network services can then be discovered or reached from unintended sources, exposing data flows, permitting unauthorized interaction, and increasing the risk of workload disruption. |
| CCC.K8S.TH10 | Workload Endpoints are Exposed Unintentionally | Services, load balancers, ingress resources, or gateways configured with an unintended external scope may make workload endpoints reachable from untrusted networks. Exposed services can then disclose workload data, accept unauthorized changes, or consume capacity needed by legitimate users. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.K8S.CN06.AR01 | When a user workload namespace is created, an enforced network policy MUST deny all ingress and egress traffic by default. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN06.AR02 | When communication is required, each allow policy MUST identify the approved source, destination, protocol, and port using stable namespace, workload, or network selectors. | tlp-clear, tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | AC-4 | Information Flow Enforcement |
| NIST_800_53 | SC-7 | Boundary Protection |