Kubernetes trusts every pod, by default.

Pod Security Standards cap what privilege a pod can run with. Network Policies add zero-trust segmentation Kubernetes doesn't provide out of the box.

Pod Security Standards

Privileged

Unrestricted. Never for app pods.

Baseline

Blocks known escalations. Reasonable minimum.

Restricted

No root, no escalation, capabilities dropped.

enforce cluster-wide

kubectl label namespace checkout \
  pod-security.kubernetes.io/enforce=restricted

Default Kubernetes

Any pod → any pod

Zero network restriction, cluster-wide. A compromised low-risk pod can freely reach a high-risk payments database.

With Network Policies

Everything else denied by default — a compromised pod is contained to only what it explicitly needs.

Caveat: NetworkPolicies only work if the cluster's CNI plugin actually enforces them — verify before trusting the YAML.

A NetworkPolicy on a CNI plugin that doesn't enforce it silently does nothing — a real, commonly-tested gotcha.