---
title: "Network policy"
description: "Secure Kubernetes workloads and hosts in connected clusters with Calico Cloud network policy — managed enforcement, tiers, recommendations, and observability."
product: "Calico Cloud"
version: "v23.0.1"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico-cloud/network-policy/"
---

# Network policy

Writing network policies is how you restrict traffic to pods in your Kubernetes cluster. Calico Cloud extends the standard `NetworkPolicy` object to provide advanced network policy features, such as policies that apply to all namespaces.

## Getting started

##### [Policy best practices](https://docs.tigera.io/calico-cloud/network-policy/policy-best-practices.md)

[Best practices for Calico Cloud policy across connected clusters — security posture, scalability with tiers, and performance tuning under load.](https://docs.tigera.io/calico-cloud/network-policy/policy-best-practices.md)

##### [Enable a default deny policy for Kubernetes pods](https://docs.tigera.io/calico-cloud/network-policy/beginners/kubernetes-default-deny.md)

[Apply a default-deny network policy in a Calico Cloud connected cluster so unprotected pods are denied traffic until explicit policy is written.](https://docs.tigera.io/calico-cloud/network-policy/beginners/kubernetes-default-deny.md)

##### [Get started with Calico network policy](https://docs.tigera.io/calico-cloud/network-policy/beginners/calico-network-policy.md)

[Write your first Calico Cloud NetworkPolicy — sample policies that exercise the rich rule features beyond Kubernetes NetworkPolicy.](https://docs.tigera.io/calico-cloud/network-policy/beginners/calico-network-policy.md)

##### [Get started with network sets](https://docs.tigera.io/calico-cloud/network-policy/networksets.md)

[Use Calico Cloud network sets to package frequently reused IP ranges or domains into named selectors that policies can reference across connected clusters.](https://docs.tigera.io/calico-cloud/network-policy/networksets.md)

##### [DNS policy](https://docs.tigera.io/calico-cloud/network-policy/domain-based-policy.md)

[Allow traffic to external destinations by DNS name using Calico Cloud domain-based policy rules — without maintaining static IP lists.](https://docs.tigera.io/calico-cloud/network-policy/domain-based-policy.md)

## Policy rules

##### [Basic rules](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/policy-rules-overview.md)

[How to write policy rules in Calico Cloud — label selectors, source and destination match criteria, and rule actions.](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/policy-rules-overview.md)

##### [Use namespace rules in policy](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/namespace-policy.md)

[Group or separate workloads in Calico Cloud policy using namespaces and namespace selectors so policies apply only to specified namespaces.](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/namespace-policy.md)

##### [Use service rules in policy](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/service-policy.md)

[Match on Kubernetes Service names in Calico Cloud policy rules instead of specific pod selectors.](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/service-policy.md)

##### [Use service accounts rules in policy](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/service-accounts.md)

[Match on Kubernetes service accounts in Calico Cloud policy rules to validate workload identity and apply RBAC-controlled rules.](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/service-accounts.md)

##### [Use external IPs or networks rules in policy](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/external-ips-policy.md)

[Restrict egress and ingress to specific IP ranges in Calico Cloud policy, either inline or via reusable network sets.](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/external-ips-policy.md)

##### [Use ICMP/ping rules in policy](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/icmp-ping.md)

[Allow or deny ICMP and ping traffic for Calico Cloud workloads and host endpoints using policy rules.](https://docs.tigera.io/calico-cloud/network-policy/beginners/policy-rules/icmp-ping.md)

## Policy tiers

##### [Get started with policy tiers](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/tiered-policy.md)

[How tiered policy works in Calico Cloud — evaluation order, pass actions, and using tiers to enforce microsegmentation across connected clusters.](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/tiered-policy.md)

##### [Change calico-system tier behavior](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/calico-system.md)

[Customize the behavior of the calico-system tier that Calico Cloud installs by default to keep its own components reachable.](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/calico-system.md)

##### [Network policy tutorial](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/policy-tutorial-ui.md)

[Tutorial for the Calico Cloud policy management UI — author, order, and stage policies inside tiers from the web console.](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/policy-tutorial-ui.md)

##### [Configure RBAC for tiered policies](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/rbac-tiered-policies.md)

[Configure Kubernetes RBAC to control which users can edit Calico Cloud policies in each tier across connected clusters.](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/rbac-tiered-policies.md)

## Policy for services

##### [Apply Calico Cloud policy to Kubernetes node ports](https://docs.tigera.io/calico-cloud/network-policy/beginners/services/kubernetes-node-ports.md)

[Restrict access to Kubernetes NodePort services using a Calico Cloud GlobalNetworkPolicy at the host endpoint.](https://docs.tigera.io/calico-cloud/network-policy/beginners/services/kubernetes-node-ports.md)

##### [Apply Calico Cloud policy to services exposed externally as cluster IPs](https://docs.tigera.io/calico-cloud/network-policy/beginners/services/services-cluster-ips.md)

[Expose Kubernetes Service ClusterIPs over BGP using Calico Cloud and restrict who can reach them with network policy.](https://docs.tigera.io/calico-cloud/network-policy/beginners/services/services-cluster-ips.md)

## Policy for extreme traffic

##### [Enable extreme high-connection workloads](https://docs.tigera.io/calico-cloud/network-policy/extreme-traffic/high-connection-workloads.md)

[Bypass Linux conntrack with a Calico Cloud policy rule for workloads that handle an extreme number of concurrent connections.](https://docs.tigera.io/calico-cloud/network-policy/extreme-traffic/high-connection-workloads.md)

##### [Defend against DoS attacks](https://docs.tigera.io/calico-cloud/network-policy/extreme-traffic/defend-dos-attack.md)

[Define DoS mitigation rules in Calico Cloud policy that drop connections at the eBPF or XDP layer, with hardware offload when available.](https://docs.tigera.io/calico-cloud/network-policy/extreme-traffic/defend-dos-attack.md)