By default every Pod can talk to every Pod; isolation is opt-in.

Once any policy selects a Pod, that Pod accepts only what policies allow. Start with default deny and add explicit allows.

default deny, then allow

kind: NetworkPolicy
metadata: {name: default-deny-all, namespace: shop}
spec:
  podSelector: {}              # ALL Pods here
  policyTypes: [Ingress, Egress]  # no rules = deny

AND versus OR

namespaceSelector and podSelector in one list item are ANDed; in two items they are ORed. One dash decides.

Policies only add

Allows are the union of every policy selecting a Pod. One permissive policy undoes a strict baseline.

Needs a capable CNI

Calico, Cilium and GKE Dataplane V2 enforce policies. A CNI without enforcement ignores them silently.

NetworkPolicy: from default-open to default-deny

Without any NetworkPolicy every Pod can reach every other Pod in the cluster: isolation is opt-in. That is a real security gap, because a compromised Pod can scan and attack everything. NetworkPolicy closes it by letting you select Pods by label and declare which ingress and egress traffic is allowed.

The recommended pattern is two steps. First a default deny policy: podSelector with empty braces selects every Pod in the namespace, and listing policyTypes with no rules allows nothing. Then add narrow allow policies, for example checkout may connect to postgres on TCP 5432. Remember to allow DNS egress on port 53 to CoreDNS, otherwise even name resolution breaks.

Two precision points. When namespaceSelector and podSelector are in the same list item they are ANDed (Pods with this label in namespaces with that label); in separate list items they are ORed, which is much broader. And policies are strictly additive: the allowed set is the union of all policies selecting a Pod, with no deny rules or precedence in the standard API, so a single permissive policy can silently undo a strict baseline.

Enforcement belongs to the CNI. Verify your CNI supports NetworkPolicy before relying on it, and test with a throwaway Pod that the denied connection actually fails. Cilium and Calico add richer policies (DNS-based egress, L7), covered in Decks 5 and 7.