Network Policy
NetworkPolicy controls network traffic between K8s Pods; default is allow-all, and policies define permitted ingress/egress rules.
Purpose
Micro-segment Pod networks for zero-trust security.
Mechanism
Selects Pods by labels and defines allowed from/to rules (IPBlock/namespaceSelector/podSelector + ports). Default deny once a policy applies; only matching rules pass. Requires CNI support (Calico/Cilium).
Use cases
- Network isolation
- Zero trust
- K8s security