Microsegmentation

Classic segmentation splits networks into a few zones (DMZ, corporate, production). Microsegmentation goes down to the workload: payments-api may talk to payments-db on 5432 and nothing else. It is enforced by host firewalls, cloud security groups, Kubernetes NetworkPolicy (via a CNI such as Cilium or Calico), or a service mesh using workload identity instead of IP addresses.

Its point is to contain lateral movement and shrink blast radius. The difficulty is knowing the real flows: start by observing traffic (flow logs, mesh telemetry), apply default-deny namespace by namespace, and treat policy as code with review.

Pitfalls: IP-based rules rot as workloads churn, and a Kubernetes cluster with no NetworkPolicy is fully flat by default.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny, namespace: payments }
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-to-db, namespace: payments }
spec:
  podSelector: { matchLabels: { app: payments-db } }
  policyTypes: [Ingress]
  ingress:
    - from: [{ podSelector: { matchLabels: { app: payments-api } } }]
      ports: [{ protocol: TCP, port: 5432 }]