---
source: https://iinventedlight.com/library/notes/kubernetes-network-policies.md
title: "Kubernetes NetworkPolicies"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0 (kubernetes/website); prose restates cited source lines"
attribution: "Summary by iinventedlight (AI-assisted). Sources: Kubernetes Authors, Network Policies, CC BY 4.0 (kubernetes/website); Kubernetes Authors, Declare Network Policy, CC BY 4.0 (kubernetes/website)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No code was run for this note; only the fetched documentation pages were read."
category: coding-references
topic_area: "code-ai-eng: Kubernetes"
tags: ['kubernetes', 'networking', 'security', 'network-policy']
sources:
  - id: S1
    title: "Network Policies"
    publisher: Kubernetes Authors
    url: https://kubernetes.io/docs/concepts/services-networking/network-policies/
    accessed: 2026-11-04
    license: "CC BY 4.0 (kubernetes/website)"
  - id: S2
    title: "Declare Network Policy"
    publisher: Kubernetes Authors
    url: https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/
    accessed: 2026-11-04
    license: "CC BY 4.0 (kubernetes/website)"
---
# Kubernetes NetworkPolicies

**Answer:** A NetworkPolicy controls traffic to and from Pods at the IP and port level (layers 3 and 4), using selectors for Pods, namespaces and IP blocks. Policies are enforced by the network plugin, so it must support them.

## Example: only labeled clients reach nginx

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: access-nginx}
spec:
  podSelector: {matchLabels: {app: nginx}}
  ingress:
  - from:
    - podSelector: {matchLabels: {access: "true"}}
```

## Key ideas

- Policies are additive: allowed traffic is the union of all policies selecting the Pod.
- Ingress and egress isolation are separate.

## Gotchas

- Without a supporting plugin, policies do nothing.

## Claims
- id: C1
  claim: NetworkPolicies control traffic at the IP address or port level.
  source: S1
  evidence: "If you want to control traffic flow at the IP address or port level (OSI"
- id: C2
  claim: Network policies are implemented by the network plugin.
  source: S1
  evidence: "Network policies are implemented by the network plugin."
- id: C3
  claim: The example policy is named access-nginx.
  source: S2
  evidence: "name: access-nginx"
- id: C4
  claim: The example policy uses a podSelector.
  source: S2
  evidence: "podSelector:"

## Sources
- [S1] Network Policies. Kubernetes Authors. https://kubernetes.io/docs/concepts/services-networking/network-policies/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.
- [S2] Declare Network Policy. Kubernetes Authors. https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).