Declare platform intents for non-Kix-managed pods

Use a platform intent when pods installed outside Kix need explicit network access. An intent identifies those pods and describes their required ingress or egress without adding them to a Kix package.

This guide assumes generated network policy is enabled and the cluster has a network policy enforcer.

Find a stable pod selector

Inspect the labels on the externally managed pods:

❱ kubectl get pods -n observability --show-labels

Choose labels maintained by the system that installs the workload. Avoid pod names and rollout-specific labels.

Add the platform intent

Add an entry under networkPolicy.platformIntents:

how-to/platform/network-policy-cluster.nix

        networkPolicy.platformIntents.metrics-agent = {
          scope = "clusterwide";
          targetNamespace = "observability";
          podSelector."app.kubernetes.io/name" = "metrics-agent";
          egress = [
            { to = "dns"; }
            {
              to = "world";
              ports = [
                {
                  port = 443;
                  protocol = "TCP";
                }
              ];
            }
          ];
        };

View source on GitHub ↗

This intent selects Pods labelled app.kubernetes.io/name=metrics-agent in the observability namespace. It allows DNS lookups and outbound HTTPS.

An intent restricts as well as permits

In Cilium, selecting an endpoint with an egress policy puts that endpoint into default-deny for egress. After this intent is applied, the selected Pods can reach DNS and TCP port 443 on the internet, but no other destinations. Existing traffic, such as scraping an in-cluster target, will be blocked unless you add a rule for it.

List every destination the workload needs, not just the destination that prompted the intent. In this example, observability contains no Kix instances, so no generated policy restricted these Pods beforehand.

Omitted directions remain unchanged. This intent declares no ingress, so it does not affect incoming traffic to these Pods.

to and from accept fixed values rather than arbitrary selectors. to accepts dns, world, apiserver, and all-pods; from accepts all-pods, world, and apiserver, which admits the Kubernetes API server calling an admission webhook or an aggregated API in the selected Pods. Anything else fails evaluation with unknown egress intent target or unknown ingress intent source.

scope = "clusterwide" creates a cluster-wide policy. The targetNamespace label constraint keeps it scoped to the intended namespace.

Example: ACME HTTP-01 solver pods

cert-manager’s controller launches an HTTP-01 solver pod in the namespace of each Certificate that an HTTP-01 issuer handles. Kix does not render these pods, so the namespace’s default deny drops the ingress controller’s requests to them and the challenge never validates. This intent admits them in every namespace:

networkPolicy.platformIntents.acme-http01-solvers = {
  scope = "clusterwide";
  podSelector."acme.cert-manager.io/http01-solver" = "true";
  ingress = [
    {
      from = "all-pods";
      ports = [
        {
          port = 8089;
          protocol = "TCP";
        }
      ];
    }
  ];
};

The selector is the label cert-manager sets on every solver pod, which the cert-manager instance also publishes as out.operandSelectors.acmesolver. Port 8089 is the port the solver listens on. The intent sets no targetNamespace, because solver pods run wherever a certificate is requested. The ingress controller must also be allowed to send traffic to the solver pods; the ingress-nginx package declares egress to all pods for its backends.

Check the generated policy

Evaluate the cluster:

kix-examples/

❱ kix check how-to-platform-network-policy
 TOOL       RESULT  DETAILS                       
 eval       pass    50 manifests evaluated        
 scorecard  pass    0 errors, 44 warnings, 5 info

Inspect the policy generated for the intent:

kix-examples/ output excerpt

❱ kix build how-to-platform-network-policy --output json
{
  "apiVersion": "cilium.io/v2",
  "kind": "CiliumClusterwideNetworkPolicy",
  "metadata": {
    "name": "metrics-agent"
  },
  "spec": {
    "egress": [
      {
        "toEndpoints": [
          {
            "matchLabels": {
              "k8s-app": "kube-dns",
              "k8s:io.kubernetes.pod.namespace": "kube-system"
            }
          }
        ],
        "toPorts": [
          {
            "ports": [
              {
                "port": "53",
                "protocol": "UDP"
              },
              {
                "port": "53",
                "protocol": "TCP"
              }
            ]
          }
        ]
      },
      {
        "toEntities": [
          "world"
        ],
        "toPorts": [
          {
            "ports": [
              {
                "port": "443",
                "protocol": "TCP"
              }
            ]
          }
        ]
      }
    ],
    "endpointSelector": {
      "matchLabels": {
        "app.kubernetes.io/name": "metrics-agent",
        "k8s:io.kubernetes.pod.namespace": "observability"
      }
    }
  }
}

The generated endpoint selector contains both the workload label and the namespace. Its egress rules allow UDP and TCP DNS traffic, plus TCP port 443 to destinations outside the cluster.

Deploy the cluster and inspect the installed policy:

kix-examples/

❱ kix deploy how-to-platform-network-policy

❱ kubectl get ciliumclusterwidenetworkpolicy metrics-agent -o yaml

If the policy does not select the expected pods, compare its endpointSelector.matchLabels with the labels reported by kubectl. All selector labels must match the same pod.