Design Network Policies

Problem Statement: Kubernetes Network Policy Platform

Fleet anchor: 120 clusters, 850k pods, 18k NetworkPolicy objects, ~2.4M active flows/sec at peak, Calico eBPF or Cilium as CNI enforcement layer.

Context for section 1 (understanding)

Interviewers expect you to frame NetworkPolicy as a label-directed firewall for pod traffic—not a replacement for cloud VPC security groups. The platform must let platform teams ship default-deny baselines while application teams add narrow allow rules without opening lateral movement paths.

Mechanisms you should articulate

1. Policy control plane stores versioned intent, validates selectors, simulates flows before admission.
2. CNI dataplane (Calico eBPF or Cilium) compiles Kubernetes NetworkPolicy + CRD extensions into enforceable rules.
3. Observability plane exports deny metrics, Hubble/Calico flow logs, and SOC dashboards for tuning.

Operational invariants

• Default deny is explicit — empty ingress/egress rule lists mean deny when policyTypes include that direction.
• DNS and apiserver egress are first-class — breaking CoreDNS or kube-apiserver egress causes cluster-wide outages.
• Shadow before enforce — log would-be denies before flipping production namespaces to enforced mode.

Edge cases

• Host-network pods bypass pod network namespace policies—call out exceptions.
• NodePort/LoadBalancer traffic hits before NetworkPolicy on some CNIs—clarify north-south vs east-west.
• Cross-namespace selectors with stale labels cause silent over-permissioning.

Metrics snapshot

How to open this one

The framing that lands for a Kubernetes network policy platform is default-deny micro-segmentation: pods can talk to nothing until an explicit policy allows it, so a compromised service cannot pivot laterally across the cluster. Lead with the policy model (label selectors, namespaces, ingress/egress rules compiled by the CNI) and the failure story that proves it: an over-tight policy silently drops CoreDNS or apiserver egress and takes the whole cluster down. That shows you understand network policy is about containing blast radius — and that the dangerous failure mode is the silent drop, which is why you shadow before you enforce.