Policy Enforcement Modes: CCA practice questions

Whether a packet is checked against policy at all depends on the agent's enforcement mode, set with the Helm value policyEnforcementMode or the agent flag enable-policy. There are three values.

The default mode leaves an endpoint unrestricted until a policy selects it. Selection then switches the endpoint into default deny, but only per direction: a selecting rule with an ingress section restricts ingress, and one with an egress section restricts egress. A pod covered by an ingress-only policy can still send traffic anywhere. The first policy you write for a workload therefore changes its behaviour for that direction from allow-all to allow-listed, which is why adding a narrow rule sometimes breaks unrelated traffic.

The always mode enforces policy on every endpoint, even if no rule selects it, so a pod with no matching allow can send and receive nothing. This includes the health endpoint that every node runs for connectivity checks; the docs recommend adding a cluster-wide policy that lets reserved:health talk to remote-node when you use always.

The never mode turns enforcement off for all endpoints, even those that rules select. Policies stay in the API but have no effect, and all traffic is allowed in both directions.

Individual policies can opt out of triggering default deny. Setting enableDefaultDeny to false for ingress or egress means the rule is ignored when Cilium decides the endpoint's default state. The documented use case is a cluster-wide policy that routes all DNS through the DNS proxy for visibility without blocking anything. There is one limit: the flag does not cover L7 rules. An HTTP rule that does not contain an L7 allow-all still rejects non-matching requests on that port.

Inside an enforced direction there is a second, smaller default. If an endpoint has no L4 policy, all ports are open; once at least one L4 rule applies, only listed ports pass, and ICMP is blocked unless it is related to an allowed connection.

What a denied client experiences is configurable too. Denied packets are dropped silently by default, so applications see timeouts. The experimental option --policy-deny-response=icmp sends ICMP Destination Unreachable back for denied egress traffic, provided the pod's ingress policy lets that ICMP in.