Topic 6: NetworkPolicy

Official baseline: (The Kubernetes Authors, 2026). My working version: NetworkPolicy is a firewall model for Pods, but only if the network plugin enforces it.

Mental Model

NetworkPolicy is a firewall model for Pods, but only if the network plugin enforces it.

Notes

• Default allow is easy; default deny is a deliberate security posture.
• Policies select Pods and then define allowed ingress or egress.
• Not every CNI has the same policy behavior or visibility.

Homelab Angle

Start by isolating one namespace and proving only the expected Services still work.

Verify It

• Read the object status before changing the manifest.
• Check events for the controller or node that is actually complaining.
• Confirm the official source linked below still matches the cluster version you run.

Common Failure Modes

• Treating the YAML object as the system, instead of one input to a reconciliation loop.
• Debugging from outside the cluster when the failure only exists inside cluster networking or node state.
• Forgetting that Kubernetes version, addon version, and runtime behavior are linked.

Sources

• Network Policies - source path: content/en/docs/concepts/services-networking/network-policies.md, commit 8cc9e19b8eec8d5cf49eacd66f86a81648edb1a0.
• Kubernetes documentation is licensed under CC BY 4.0; these notes are original commentary and link back to the official source.

The Kubernetes Authors. (2026). Network Policies. https://kubernetes.io/docs/concepts/services-networking/network-policies/