Networkpolicy on marktaguiad.dev

Cilium Network Policy: CiliumNetworkPolicy

marktaguiad@marktaguiad.dev (Mark Taguiad) — Tue, 28 Apr 2026 00:00:00 +0000

CiliumNetworkPolicy (CNP) is the most commonly used policy type in Cilium.

It is namespace-scoped, meaning the policy applies only within the namespace where it is created.

This is the policy most teams use for real-world application security because it enables zero-trust controls at Layer 3, Layer 4, and Layer 7.

If Kubernetes NetworkPolicy is a basic firewall, CiliumNetworkPolicy is the full application-aware policy engine.

What discussed and showed here is similar with CiliumClusterwideNetworkPolicy, the only difference it the policy is cluster wide. Read more on that topic and how to combine these policies.

Cilium Network Policy: Kubernetes NetworkPolicy

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sun, 26 Apr 2026 00:00:00 +0000

When people first start working with Cilium policies, the easiest way to understand them is to group them into two simple ideas:

Who can talk to what?
What they’re allowed to do once connected?

That mental model maps directly to how Cilium builds policy enforcement—from basic workload isolation all the way up to application-aware HTTP filtering.

If you already think in terms of namespace rules and Layer 7 rules like HTTP GET/POST like we did in Istio, you’re already on the right track. Cilium simply expands that model into something much more powerful and much more granular.