Kubernetes · Orchestration under pressure

How do NetworkPolicies work and what are their limits?

Hardnetwork-policiessecuritynetworkingUpdated Oct 2026

Short answer

NetworkPolicies declare allowed L3/L4 traffic between pods and namespaces. They are additive and only enforced if the CNI plugin supports them, and they do not encrypt traffic.

By default most clusters allow all pod-to-pod traffic. A NetworkPolicy selects pods and defines allowed ingress or egress. Once a pod is selected by a policy for a direction, that direction becomes deny-by-default except for the rules listed. Policies are additive: multiple matching policies union their allowances.

The CNI must implement NetworkPolicy; some simple plugins do not
Default-deny ingress and egress is the safest starting point
Selectors can match pods, namespaces and IP blocks
Policies are stateful for connections in some implementations, so verify behaviour
NetworkPolicy does not provide encryption, identity or L7 filtering

yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Selecting all pods and listing only Ingress denies all inbound traffic.

Roll out policies carefully. A default-deny policy will break DNS, health checks and metrics scraping unless you add explicit allowances. Start in audit or a staging namespace, map real traffic flows, then enforce. Document the intended communication graph so policies remain maintainable.

NetworkPolicy is not a substitute for authentication or authorization. It limits who can reach a port, not what an allowed client may do once connected.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

1What happens when a pod is selected by an ingress policy with no rules?
2Why does default-deny often break DNS?
3Are NetworkPolicies additive or subtractive?
4What does NetworkPolicy not protect against?

Say it in the interview

NetworkPolicies are additive L3/L4 rules that select pods and allow traffic in a direction. Once a pod is selected for ingress or egress, that direction becomes deny-by-default except for the listed peers. The CNI must enforce them, and default-deny will break DNS and metrics unless I add explicit rules. I map traffic flows first and roll policies out gradually because these mistakes are easy to miss until an incident.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Kubernetes mock interview and get scored feedback on depth, clarity and confidence.

Start a free Kubernetes interview Browse all questions

Follow-ups you should expect

Related questions

Now say it out loud.