Kubernetes Network Policies control access at the packet level inside a cluster. They decide which pods can talk to which, across namespaces and IP blocks. When something fails, the default silence makes debugging hard. Without debug logging, all you see is blocked traffic with no reason attached.
Enabling debug logging for Kubernetes Network Policies starts with the CNI plugin in use. Calico, Cilium, and other CNIs each have their own logging configuration. For Calico, set the LogSeverityScreen to Debug in the Felix configuration. This exposes granular details of policy enforcement. For Cilium, toggle debug mode via cilium config and inspect the agent logs. Always restart any updated pods or daemons to apply the change.
Use kubectl describe networkpolicy <policy-name> as a baseline. This command shows the spec—ingress rules, egress rules, selectors. Then watch the logs from the CNI pod daemonset. Look for entries that match the dropped connection’s source and destination. The combination of policy spec and debug logging will reveal if a label mismatch or namespace isolation is causing the denial.
When monitoring, pair debug logs with kubectl exec into affected pods and run network tests. Simple curl or netcat commands can confirm which rules are blocking traffic. Match the timestamps in your test to the CNI debug entries. This correlation is the fastest path to uncovering the cause.