--- title: "Securing Namespaces and Services in Kubernetes" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/securing-namespaces-and-services-in-kubernetes/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Securing Namespaces and Services in Kubernetes By [Casey Davenport](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/caseydavenport/) on Nov 06, 2015 • 3 min read ## **Namespace and Service Policy** Calico has provided secure networking for Kubernetes clusters for a while now, as demonstrated in this [blog post](http://dev-project-calico.pantheonsite.io/calico-network-policy-comes-to-kubernetes/) from earlier this year.  Our annotation-based security policy allows fine-grained policy declaration at the pod-level.  We’ve recently been working to bring that policy to Kubernetes namespaces and services. ### **Policy at the Namespace Boundary** We think that Kubernetes namespaces are a logical choice for coarse-grained network policy.   This allows you to secure groups of pods using broad strokes, eliminating the need to declare policy on each pod individually.  In this design, namespaces can be declared as “open” or “closed”.  Pods and services in open namespaces are accessible from anywhere, while pods and services in a closed namespace are accessible only from within that namespace.  You can think of this as a logical firewall at the namespace boundary (though in Calico, each pod in that namespace is protected by its own iptables firewall).  This allows you to do things like isolate applications, tenants, or development and production workspaces. The demo video above uses two closed namespaces – client and webapp.  Pods and Services created in a closed namespace are only accessible by other pods within that same namespace, unless they are exposed using a service (see below).  This allows you to secure your applications from the outside world. A common use for an “open” namespace would be for services like DNS, which need to be accessible across the entire cluster. ### **Applying Policy using Services** A closed namespace isn’t particularly useful on its own, since nothing within the namespace is accessible to the outside world! That’s where services come in.  Services allow you to expose pods outside of a closed namespace – essentially poking holes in the logical namespace firewall. In the video above, we expose the frontend service by applying a special label – “projectcalico-policy=open”.  This indicates that the service should be exposed outside of a closed namespace.  Kubernetes services already know which ports and protocols should be accessible on the underlying pods, so we can open the precise IP / protocol / port combination to expose the service. ### **What’s Next?** We’d love to see this simple API implemented in Kubernetes, removing the need for special labels, and replacing them with native fields in the API.  We’ve proposed this approach to the Kubernetes community in this [issue](http://github.com/kubernetes/kubernetes/issues/13459), and we’d love to hear your feedback. While this demo is still a proof-of-concept, we imagine this API being built upon down the road, allowing for more general intent-based policy.  For example, a Kubernetes API object specifically for painting network policy across a selection of pods, or using a label selector to expose services to a group of pods or other services based on labels, allowing fine-grained control of who can access your services. [Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Project Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/project-calico/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/What-is-new-in-Calico-winter-2026.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 4, 2026 AI Powered Intelligence, Unified Traffic Observability and Scalable Infrastructure Management As anyone managing one or more Kubernetes clusters knows by now, scaling can introduce an exponentially growing number of problems. The sheer volume of metrics,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/)