Municipal HR applies a deny-all NetworkPolicy in a shared namespace…

Question

Municipal HR applies a deny-all NetworkPolicy in a shared namespace and immediately loses access from their management Pods to the API Pods they still need. What operational lesson applies?

Accepted Answer

Deny-all policies have a wide blast radius; stage allow rules for required peers (and break-glass access) before or with the deny posture. — Slamming every door shut locks you out too — plan the allow-list and a break-glass path before flipping deny-all.

Answer

Deny-all NetworkPolicies only affect Pods created after the policy and never disturb existing connections.

Answer

kube-apiserver automatically injects allow-all exceptions for any Pod with a ServiceAccount.

Answer

Deny-all policies are namespaced but silently skip Pods whose containers run as UID 0.

Municipal HR applies a deny-all NetworkPolicy in a shared namespace and immediately loses access from their management Pods to the API Pods they still need. What operational lesson applies?

Short Explanation

Full Explanation