NetworkPolicy closes Kubernetes' default-open east-west network

Namespaces do not isolate traffic. Start each application namespace with default deny, then permit only named dependencies and DNS.

Default open

Without a selecting policy, Pods can communicate freely.

Default deny

Select every Pod and allow no ingress or egress.

Explicit allow

checkout may call payments on the required port only.

Keep DNS

Egress policy must preserve name resolution to the cluster DNS service.

Policy is additive: audit every policy selecting a Pod to know the effective allow set.

NetworkPolicy closes Kubernetes' default-open east-west network

NetworkPolicy on GKE is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. Dataplane V2 enforces Kubernetes NetworkPolicy. Policies are additive, so multiple allows combine rather than a later deny overriding an earlier rule. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `kubectl get networkpolicy -A`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: A default-deny egress rollout commonly breaks DNS or workload identity metadata access; test in staging and include required system destinations. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. North-south traffic now lands on Pod endpoints through NEGs.