Comparison
Network policyvsZero-trust networking
Network policy
the workload can reach only the three services it declared, and its attempt to open a connection anywhere else times out silently.
Rules restricting which workloads may talk to which, enforced in the network layer by label selectors rather than by addresses. It is the practical form of microsegmentation and the main tool for containing lateral movement after a compromise. Two things bite: the default is allow-all until a policy selects a workload, at which point it becomes deny-by-default, and rejected traffic usually manifests as a timeout rather than a refusal.
Full entry →Zero-trust networking
being inside the network gets a caller nothing; every call is authenticated and authorised on its own merits.
Designing on the assumption that the network is hostile, so location confers no privilege and each request carries and proves identity. It is the answer to the flat internal network where one compromised host reached everything. In practice it is workload identity plus mutual TLS plus per-call authorisation, and the hard part is never the cryptography — it is enumerating who is allowed to call what, which nobody has written down.
Full entry →