Absent or ineffective ingress and egress policies may allow traffic to flow between namespaces, workloads, and external systems without an explicit authorization boundary. Network services can then be discovered or reached from unintended sources, exposing data flows, permitting unauthorized interaction, and increasing the risk of workload disruption.
Workload Network Segmentation is Not Enforced
CCC.K8S.TH06
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP07 | Cluster Network Integration | The service can attach cluster, node, pod, and service connectivity to a user-configured cloud virtual network. |
| CCC.K8S.CP09 | Workload Network Policy | The service may be configured with Kubernetes network policies that enforce ingress and egress boundaries between workloads and external systems. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN06 | Enforce Default-Deny Workload Network Policies | Confine workload communication to flows permitted by explicit, least-privilege network policies, with all other traffic denied by default. |