A transit team creates a NetworkPolicy whose podSelector matches on…

Question

A transit team creates a NetworkPolicy whose podSelector matches only Pods with tier=backend. Unlabeled Pods in the same namespace still accept connections from anywhere. Why?

Accepted Answer

NetworkPolicies apply only to Pods that match their podSelector in that namespace; unmatched Pods remain unrestricted by that policy. — Policies only lock the lockers whose labels match the tag on the policy — unlabeled lockers stay wide open under that rule.

Answer

Unlabeled Pods automatically inherit every NetworkPolicy in the cluster including other namespaces.

Answer

kube-proxy ignores NetworkPolicy unless the Pod annotation networking.k8s.io/policy=true is set.

Answer

Unlabeled Pods are forced onto HostNetwork, which NetworkPolicy always isolates by default.

A transit team creates a NetworkPolicy whose podSelector matches only Pods with `tier=backend`. Unlabeled Pods in the same namespace still accept connections from anywhere. Why?

Short Explanation

Full Explanation