Platform & DevOps·Traffic into and inside the cluster
the workload can reach only the three services it declared, and its attempt to open a connection anywhere else times out silently.
Network policy
Also calledpod firewall, microsegmentation
Rules restricting which workloads may talk to which, enforced in the network layer by label selectors rather than by addresses. It is the practical form of microsegmentation and the main tool for containing lateral movement after a compromise. Two things bite: the default is allow-all until a policy selects a workload, at which point it becomes deny-by-default, and rejected traffic usually manifests as a timeout rather than a refusal.