Network Policies: Namespace Isolation and Pod-to-Pod Rules

Calendar February 22, 2026
Kubernetes
Intermediate
Network-Policy-Design, Namespace-Isolation, Cluster-Security
Network-Policies, Security, Namespaces, Cni, Calico
Kubectl, Calico, Cilium

Network Policies: Namespace Isolation and Pod-to-Pod Rules#

By default, every pod in a Kubernetes cluster can talk to every other pod. Network policies let you restrict that. They are namespace-scoped resources that select pods by label and define allowed ingress and egress rules.

Critical Prerequisite: CNI Support#

Network policies are only enforced if your CNI plugin supports them. Calico, Cilium, and Weave all support network policies. Flannel does not. If you are running Flannel, you can create NetworkPolicy resources without errors, but they will have absolutely no effect. This is a silent failure that wastes hours of debugging.