--- title: "Dry Run: Your Kubernetes network policies with Calico staged network policies" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/dry-run-your-kubernetes-network-policies-with-calico-staged-network-policies/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Dry Run: Your Kubernetes network policies with Calico staged network policies By [Reza Ramezanpour](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/rezar/) on Jul 15, 2025 • 6 min read Kubernetes Network Policies (KNP) are powerful resources that help secure and isolate workloads in a cluster. By defining what traffic is allowed to and from specific pods, KNPs provide the foundation for zero-trust networking and least-privilege access in cloud-native environments. But there’s a problem: KNPs are risky, and applying them without a clear game plan can be potentially disruptive. Without deep insight into existing traffic flows, applying a restrictive policy can instantly break connectivity killing live workloads, user sessions, or critical app dependencies. An even scarier scenario is when we implement policies that we think cover everything and workloads actually work, but after a restart or scaling operation we hit new problems. Kubernetes, with all of its features, has no built-in “dry run” mode for policies, and no first-class observability to show what would be blocked or allowed which is the right decision since Kubernetes is an orchestrator not an implementer. This forces platform teams into a difficult choice, deploy permissive or no policies and weaken security, or Risk service disruption while debugging restrictive ones. As a result, many teams delay implementing network policies entirely only to regret it after a zero-day exploit like Log4Shell, XZ backdoor, or other vulnerabilities that can impact production. ## Impact The fear of breaking something becomes the top reason why Kubernetes environments go unsegmented. You can’t enforce what you can’t test safely. For instance, let’s say you want to secure a workload deployed by another team. You don’t control how it was configured. You’re tasked with writing a network policy, but: - You don’t know what dependencies it has. - You don’t know what clients are connecting to it. - You don’t want to cause downtime by getting it wrong. This leads to situations where security takes a backseat to stability. Policies get delayed or shelved. And worst of all, the blast radius remains wide open. ## Resolution That’s why **[Calico Open Source v3.30](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-calico-3-30-a-new-era-of-open-source-network-security-and-observability-for-kubernetes/) introduces Staged Network Policies**, a simple but powerful way to test policies safely, with zero risk to production traffic. A staged policy audits what would happen if it were enforced without taking action on packets. Here’s how it works: - You write a `StagedNetworkPolicy` just like a regular KNP. (More about this later!) - Calico evaluates it during traffic processing, but doesn’t block or allow traffic based on it. - Instead, all decisions made by the staged policy are logged and viewable in Whisker or Service Graph in Calico Cloud Free Tier. The best part about Calico is its interoperability, this means you can use staged policies to even evaluate your [Kubernetes network policies](https://wordpress-1075849-4005834.cloudwaysapps.com/learn/guides/kubernetes-security/kubernetes-network-policy/). ## Let’s Set the Scene **Note:** If you would like to run the experiment in your own environment, [click here](https://github.com/frozenprocess/calico_live/tree/main/sessions). To better understand staged network policies, let’s go over a scenario. Imagine we’re trying to secure an app called [anp-demo-app](https://github.com/frozenprocess/anp-demo-app/tree/main/manifests), running in the `web-demo` namespace. We don’t have control over how it was deployed, or anything about its required communication channels, and we can’t risk any downtime. However, to secure our app we need to implement policies so let’s evaluate what happens when we apply some KNPs to our workload. ![ANP Demo App shows container connectivity to Internet, coredns, DNS, and Kubernetes API.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Dry-Run-Your-Kubernetes-network-policies-with-Calico-staged-network-policies-1.png) With plain KNPs, we might write something like this. An explicit allow to match our workloads ingress and deny any egress, and a default deny to match every traffic other than what we explicitly allowed in that namespace: ``` `apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-http-ingress namespace: web-demo spec: podSelector: {} policyTypes: - Ingress - Egress ingress: - from: ports: - port: 80 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-my-app namespace: web-demo spec: podSelector: {} policyTypes: - Ingress - Egress` ``` Apply that and boom! The app stops responding. Something got missed, and we can verify it by opening the customer facing page again. ![ANP Demo App displays container connectivity failures and one successful API server connection.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Dry-Run-Your-Kubernetes-network-policies-with-Calico-staged-network-policies-2.png) As you can see, our application is now being blocked by our policies and for a production environment this means downtime. ## The Power of Staged Network Policies Now, let’s delete the Kubernetes Network Policy resources that we created earlier and try the safe way with Calico staged policies. Staged network policies are unique Calico resources and all you need to do to use them is to change the `apiVersion` and add a prefix to your current policies. In our case, we need to change the `apiVersion` from `networking.k8s.io/v1` to `projectcalico.org/v3` and change the resource `Kind` to `StagedKubernetesNetworkPolicy`. **Note:** We are using `StagedKubernetesNetworkPolicy` specifically to target Kubernetes-native network policies. This distinction is important because Calico defines its own custom resources, NetworkPolicy and GlobalNetworkPolicy, which share the same name as Kubernetes NetworkPolicy but offer advanced capabilities. Calico’s policies support powerful features such as: - **Global policy scope** for cluster-wide enforcement - **Granular traffic control** beyond namespace boundaries - **HostEndpoint targeting**, enabling enforcement on host-level components like network interfaces, sockets, and ipsets, capabilities that standard Kubernetes network policies cannot achieve. If you’d like to learn more about Calico network policies, [click here](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy). Now let’s try the same thing using StagedKubernetesNetworkPolicy: ``` `apiVersion: projectcalico.org/v3 kind: StagedKubernetesNetworkPolicy metadata: name: allow-http-ingress namespace: web-demo spec: podSelector: {} policyTypes: - Ingress - Egress ingress: - from: ports: - port: 80 egress: [] --- apiVersion: projectcalico.org/v3 kind: StagedKubernetesNetworkPolicy metadata: name: deny-my-app namespace: web-demo spec: podSelector: {} policyTypes: - Ingress - Egress` ``` This time, the application stays up. Everything works as before. Why? Because Calico Staged policies don’t affect traffic it only audits enforcement. You might be wondering that is great but how can I verify my staged network policies are actually doing something? ## Where to Observe Staged Policies? Using [Whisker](https://app.arcade.software/share/MC2wAFYlW1RJxKdWzZBl), Calico’s observability UI, we can: - Filter traffic flows by **staged policy decisions**, - See which connections would have been **allowed or denied**, - Get visibility into **source, destination, namespace, labels, ports**, and more. This observability gives you complete confidence. Once the staged policy behaves exactly how you want, simply promote it to a real KNP or convert it to a Calico-native `NetworkPolicy` resource for advanced features. ## Go Even Further With Calico Cloud Free Tier Whisker is a simple and powerful tool that gives you observability, and if you like that you will love [Calico Cloud Free Tier](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-calico-cloud-free-tier/). Basically, its enterprise features that we offer to our customers for free. All you need to do is to head over to [calicocloud.io](https://www.calicocloud.io) and register a new account. No credit card required! ## Outcome Security shouldn’t require courage. With Calico’s staged policies, it doesn’t. Staged network policies are unique Calico resources that allow you to safely try and troubleshoot your policies inside or outside a production environment. This unique feature allows you to: ✅ Validate policies in real time without affecting traffic ✅ Iterate and improve security posture with no guesswork ✅ Enable DevSecOps workflows that are fast, safe, and visible ✅ Build least-privilege access confidently and continuously [Check out Calico Staged Network Policy in action in this demo](https://app.arcade.software/share/lr0xe33dw8UdAyrzDEQH) [How-To](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/how-to/)[Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-20-AI-Assistant-for-Calico.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) #### [AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 19, 2026 Despite the wealth of data available, distilling a coherent narrative from a Kubernetes cluster remains a challenge for modern infrastructure teams. Even with powerful visualization tools like the Policy Board, Service Graph, and specialized dashboards,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) [![What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-18-What-Your-EKS-Flow-Logs-Arent-Telling-You.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) #### [What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) By [Phil DiCorpo](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/phil-dicorpo/) on Mar 18, 2026 If you’re running workloads on Amazon EKS, there’s a good chance you already have some form of network observability in place. VPC Flow Logs have been a staple of AWS networking for years, and AWS... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/)