Comparison
Network policyvsSecurity group
Network policy
the workload can reach only the three services it declared, and its attempt to open a connection anywhere else times out silently.
Rules restricting which workloads may talk to which, enforced in the network layer by label selectors rather than by addresses. It is the practical form of microsegmentation and the main tool for containing lateral movement after a compromise. Two things bite: the default is allow-all until a policy selects a workload, at which point it becomes deny-by-default, and rejected traffic usually manifests as a timeout rather than a refusal.
Full entry →Security group
the port is open in the application and the connection still hangs, because a rule two layers below never allowed it.
A stateful firewall attached to cloud resources, allowing traffic by port, protocol and source. It is the layer people forget when debugging connectivity, because it fails by dropping rather than refusing, so the symptom is a timeout with nothing in any log. Referencing other groups rather than address ranges is what keeps the rules meaningful as instances come and go.
Full entry →