← All notes

Answer: A NetworkPolicy controls traffic to and from Pods at the IP and port level (layers 3 and 4), using selectors for Pods, namespaces and IP blocks. Policies are enforced by the network plugin, so it must support them.

Example: only labeled clients reach nginx

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: access-nginx}
spec:
  podSelector: {matchLabels: {app: nginx}}
  ingress:
  - from:
    - podSelector: {matchLabels: {access: "true"}}

Key ideas

• Policies are additive: allowed traffic is the union of all policies selecting the Pod.
• Ingress and egress isolation are separate.

Gotchas

• Without a supporting plugin, policies do nothing.

Claims

• id: C1 claim: NetworkPolicies control traffic at the IP address or port level. source: S1 evidence: "If you want to control traffic flow at the IP address or port level (OSI"
• id: C2 claim: Network policies are implemented by the network plugin. source: S1 evidence: "Network policies are implemented by the network plugin."
• id: C3 claim: The example policy is named access-nginx. source: S2 evidence: "name: access-nginx"
• id: C4 claim: The example policy uses a podSelector. source: S2 evidence: "podSelector:"

Sources

• [S1] Network Policies. Kubernetes Authors. https://kubernetes.io/docs/concepts/services-networking/network-policies/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.
• [S2] Declare Network Policy. Kubernetes Authors. https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_pveh7mqm,
  author = {{iinventedlight}},
  title = {{Kubernetes NetworkPolicies}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/kubernetes-network-policies/},
  note = {Permanent ID iil:note:pveh7mqm. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/kubernetes-network-policies.md.