Kubernetes networking is flat by default, and many services assume the cluster network is trusted. A NetworkPolicy object only takes effect if the network plugin enforces it; some plugins silently ignore it.
- Apply a default-deny NetworkPolicy for ingress and egress in every namespace, then allow the flows each application needs, including DNS.
- Restrict egress, including to the cloud metadata address, so a compromised pod cannot reach other systems or exfiltrate freely.
- Use host networking only where it is essential, such as the network plugin's own pods.
- Confirm the network plugin enforces NetworkPolicy, and test allowed and forbidden connections on the real cluster.
Guides on this site
Practice
- Privileged container lab: Reject a privileged workload before deployment · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- Verify Kubernetes admission and network boundaries · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.