Kubernetes Network Policies control how pods talk to each other and to the outside. They are declarative. They match labels. They use selectors. And they are entirely user config dependent. That means every allow or deny comes from YAML that a human writes. Mistakes in that config decide whether your service breathes or chokes.
A NetworkPolicy in Kubernetes works at the namespace level. By default, pods accept all inbound and outbound connections. The moment you apply a policy, that changes. The rules you define—ingress, egress—become the gatekeepers. If you allow only certain labels or CIDRs, only those connections will pass. If you forget to allow DNS, your app will fail silently on startup.
User config dependency is both power and risk. It gives total control. It puts zero safety nets between a wrong label and a critical outage. Even experienced teams misfire when multiple policies overlap in complex deployments. One namespace policy combined with a pod-level policy can cancel each other out. The API server will enforce whatever the config says, but it won’t warn you if the combination is lethal.