--- title: "Egress Access Control for Kubernetes Workloads" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/egress-access-control-for-kubernetes-workloads/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Egress Access Control for Kubernetes Workloads By [Bikram Gupta](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/bikramgupta/) on May 12, 2020 • 4 min read Consider an enterprise hybrid cloud deployment with hundreds of nodes and thousands of pods. These systems are running business applications with different levels of security requirements. A first-order security and compliance requirement in such a scenario is to ensure that a pod or host is only allowed to talk to authorized destinations. Now consider the real life scenario where there’s a churn rate (pods/hosts being added/removed) of hundreds of pods/minute. The challenge is to continue enforcing these security controls in near real time despite a high churn rate. An efficient mechanism for security controls has a direct impact on productivity. Ideally, you do not want to wait days for an access policy to be granted through a ticketing process, nor do you want to wait precious minutes for a policy change to take effect. Security controls have two broad categories, East-West (E-W) and North-South (N-S). Egress access control refers to N-S security on egress. The following are typical use cases of egress access control: - Configure default-deny without blocking access to essential services - Permit access to specific Internet APIs (slack, twilio, watson etc.) - Permit access to internal resources in the corporate network (database, VMs etc.) - Automatic enforcement of egress policy on VM’s as they come up (autoscaling, new node provisioning etc.) Network Policy in Calico Enterprise helps you address the use cases above. ## How does it work? ![Diagram of a Kubernetes pod with policy enforcement points at the container, pod, and host levels](/app/uploads/2019/10/Enforce-Security.png) Calico Enterprise uses a single policy language across all resources (pods, VMs, bare metal). The egress access control for pods is enforced on the pod-to-host interfaces. The egress access control for hosts is enforced on the host interface. At the heart of the enforcement is the concept of labels. Consider a simple example as shown below. This policy applies to a selector with key=my-pod-label, and value=my-value. This label can be present on a pod or a host. ![YAML code showing a GlobalNetworkPolicy with selector 'my-pod-label == 'my-value](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2020/05/Egress-Access-Control-for-Kubernetes-Workloads.png) The access rule of the policy permits access to any destination with key=color and value=red. That destination can be any resource (pod, host, networkset etc.). This is the elegance of having a single policy language across all your hosts and pods. The backend processing of access policies is equally simple. Calico runs a daemon on every Kubernetes node and non-Kubernetes host that you protect. Any change in configuration is sent to etcd (Kubernetes datastore). Calico-nodes watch for any change and pull the change. Calico is proven to scale in large-scale deployments with thousands of nodes. ## Why does this matter? - Egress access control with default-deny is the first order requirement for security and compliance in hybrid cloud datacenter. - Calico network policies reduce operational overhead in managing access control. You create declarative access policies which do not need to be changed often, if designed properly. - With one policy, you can enforce access controls across pods and hosts. No hidden clause. All you need is labels on the pods/hosts. Configuration is stored in the same kubernetes datastore (etcd), simplifying operations. ## How do I enable Egress Access Control? It is a core feature of Calico Enterprise. Refer to the sample blueprints. - [Deny all egress traffic](https://docs.tigera.io/calico-enterprise/latest/network-policy/). - [Permit egress based on network-set](https://docs.projectcalico.org/security/external-ips-policy#limit-traffic-to-or-from-external-networks-global-network-set). - [Permit egress based on domain](https://docs.tigera.io/calico-enterprise/latest/network-policy/get-started/kubernetes-policy-advanced#5-allow-dns-egress-traffic). The important part is to have a solid egress control framework that scales as you expand clusters, teams and applications. - Establish a process on who is authorized to manage the egress policies. Define and enforce the policy life-cycle from access request to enforcement to monitoring. - Implement a design so you have to make minimal changes to policies. The way to achieve this is to group the resources into (global) network sets. As the external resource access requirement changes, you simply update the network set. As new pods need access to external resources, you simply label the pods. - Have the deny-all in place. To learn more about egress access control… Policy rules in Calico: [https://docs.projectcalico.org/security/policy-rules](https://docs.projectcalico.org/security/policy-rules) Protect Kubernetes nodes in Calico: [https://docs.projectcalico.org/security/kubernetes-nodes](https://docs.projectcalico.org/security/kubernetes-nodes) Protect hosts: [https://docs.projectcalico.org/security/tutorials/protect-hosts](https://docs.projectcalico.org/security/tutorials/protect-hosts) Automatic host endpoints: [https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/kubernetes-nodes#automatic-host-endpoints](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/kubernetes-nodes#automatic-host-endpoints) Domain name in policy rules for pods and hosts: [https://docs.tigera.io/calico-enterprise/latest/network-policy/domain-based-policy#trusted-dns-servers](https://docs.tigera.io/calico-enterprise/latest/network-policy/domain-based-policy#trusted-dns-servers) [How-To](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/how-to/)[Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-20-AI-Assistant-for-Calico.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) #### [AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 19, 2026 Despite the wealth of data available, distilling a coherent narrative from a Kubernetes cluster remains a challenge for modern infrastructure teams. Even with powerful visualization tools like the Policy Board, Service Graph, and specialized dashboards,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) [![What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-18-What-Your-EKS-Flow-Logs-Arent-Telling-You.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) #### [What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) By [Phil DiCorpo](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/phil-dicorpo/) on Mar 18, 2026 If you’re running workloads on Amazon EKS, there’s a good chance you already have some form of network observability in place. VPC Flow Logs have been a staple of AWS networking for years, and AWS... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) [![Kubernetes Network Observability: Comparing Calico, Cilium, Retina, and Netobserv](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Feb-11-Comparing-Calico-Cilium-Retina-and-Netobserv-1.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-network-observability-comparing-calico-cilium-retina-and-netobserv/) #### [Kubernetes Network Observability: Comparing Calico, Cilium, Retina, and Netobserv](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-network-observability-comparing-calico-cilium-retina-and-netobserv/) By [Reza Ramezanpour](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/rezar/) on Feb 11, 2026 Calico, Cilium, Retina, and Netobserv: Which Observability Tool is Right for Your Kubernetes Cluster? Network observability is a tale as old as the OSI model itself and anyone who has managed a network or even... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-network-observability-comparing-calico-cilium-retina-and-netobserv/)