Hands-on Lab·Kubernetes and Cloud Native Associate
NetworkPolicy Scope and Limitations
Two Pods talk in plaintext, a default-deny stops them dead, and one label-based rule lets exactly one caller back in. Then `kubectl explain` shows the ceiling: addresses and ports, no identity and no HTTP - which is the whole reason meshes exist.
Networking and Discovery Guide 18 of 46 Intermediate
- Kubernetes1.36.4
- CNICalico v3.25.0
- Service meshnone installed
- TimeAbout 18 min
- Reviewed22 August 2026
Written against the versions above. NetworkPolicy enforcement needs a CNI plugin that implements it. Calico does; some plugins accept the object and enforce nothing.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A CNI plugin that enforces NetworkPolicy. Calico, Cilium and Antrea do; check yours before concluding a policy does not work.
- The Services and DNS guides from the fundamentals track.
-
By default, everything can reach everything
-
Default-deny, and the shape of the object
-
Let exactly one caller back in
-
The ceiling, in two explain outputs