At the city of Linjiang stood three large compounds: Egret House, where the accountants lived; Green-Tile House, where the couriers worked; and South Gate House, where the night-watch dogs were kept.

There had never been many rules. The courtyards were connected by open lanes, and no one cared which alley a visitor used. The accountants could wander into Green-Tile House to borrow carrier pigeons, and the dogs from South Gate House could nose into every kitchen looking for scraps. Most days it caused no trouble — until one rainy night.

That night, a stranger came through the gates trailing mud. He rifled through Egret House’s ledgers, slipped down the back lane into South Gate House, and finally threw an entire sack of undelivered letters from Green-Tile House into the river. Only at dawn did the governor understand: more gates do not mean better gates; convenience without rules is merely trouble that has not arrived yet.

The governor summoned an old craftsman who had built defenses on the frontier. The craftsman did not give every resident a key, nor assign a guard to follow each person. He hung a wooden plaque on every compound.

Egret House’s plaque said “accountant.” Green-Tile House said “courier.” South Gate House said “watch.” Each room inside the compounds received a smaller plaque of its own. “From now on,” said the craftsman, “the gatekeepers will not recognize faces. They will recognize plaques. What the plaque says decides where something may enter and where it may go.”

The first rule belonged to Egret House: only a “courier” from Green-Tile House could enter the accounting room; a “watch” dog from South Gate House could not. The second rule belonged to Green-Tile House: only an “accountant” from Egret House could come in to collect letters. The two rules governed two different gates — one controlled entry, the other departure.

At first everyone thought it straightforward. But the next day Egret House stopped receiving the city’s medicine lists. “I did not block them,” said the accountant. The craftsman investigated and discovered that Egret House’s back gate now allowed nothing to leave. The accountants could not even ask the timekeeper at the city gate whether a medicine cart was on its way.

So the craftsman added a narrow rule beside the back gate: the accountants could ask the timekeeper, but only that person; they could send a letter to the medicine depot beyond the wall, but could not hand their ledgers to an unknown caravan. Do not open every gate. Leave only the necessary paths open.

Green-Tile House caused an even subtler problem. The craftsman wanted “courier” to be both the name of a compound and the plaque on one particular room. Someone wrote both plaques into one rule, and the gatekeeper treated them as two conditions: a visitor had to be from Green-Tile House and belong to that room. Someone else wrote the plaques as separate rules, and the gatekeeper treated them as two alternative routes.

The craftsman rearranged the plaques. “Two plaques on the same route must both match — AND. Two routes at the same gate mean either route may be used — OR. A rule is not defined by how it looks, but by how its pieces combine.”

On the fiercest day of the rainy season, the governor decided to make South Gate House a truly isolated compound. He hung a blank plaque and wrote no allowed paths beneath it. Outsiders could no longer enter, but the people inside could not leave either. The watch dogs could not run to the kitchen, and the kitchen could not send them food.

“This is not a gate,” complained the kennel keeper. “It is four walls.”

“Yes,” said the craftsman. “Build the walls first, then open the necessary gates one by one. If everyone can walk everywhere at the beginning, no one will know which gate should never have been open.”

From then on, the city’s rules no longer described exactly who someone was. They described which kinds of compounds could communicate with which other kinds. A new room inherited the right gate rules simply by hanging the right plaque; an old room could change its name without silently changing its paths, as long as its plaques stayed the same.

But the craftsman left one final warning: “The gate rules are combined. One rule does not erase another. If you want to add a path, add it clearly. If you think a written prohibition will cancel a path someone else allowed, the rain will prove you wrong.”

— By now you have probably recognized it: this is Kubernetes NetworkPolicy.

What it is

Kubernetes NetworkPolicy is a declarative set of boundaries for Pod traffic. It controls two directions: Ingress (traffic entering a Pod) and Egress (traffic leaving a Pod). A policy uses a podSelector to choose the Pods it protects, then uses a namespaceSelector, another podSelector, or an ipBlock to describe allowed sources or destinations.

A crucial detail is that policies are additive allow rules, not mutually overriding deny lists. Once a Pod is selected by an Ingress policy, the sources it may receive from are the union of the sources allowed by every matching policy. Once selected by an Egress policy, its allowed destinations are the union of every matching policy’s destinations. Kubernetes has no universal “explicit deny” entry that overrides all allowed rules.

Therefore, selecting a Pod with an empty Ingress or Egress rule commonly creates default denial for that direction: isolate first, then add the paths that are actually needed. A connection can succeed only when both directions permit it: the destination Pod’s Ingress must allow the traffic, and the source Pod’s Egress must also allow it if the source is egress-isolated.

Selector composition is another common trap. A namespaceSelector and podSelector in the same rule mean “both must match”: a Pod with the specified labels from the specified namespace. Separate rule entries generally mean “either one may match.” If DNS, monitoring, service discovery, or another required dependency is forgotten behind default denial, an application can look healthy while being unable to function.

Why it matters

Without NetworkPolicy, a cluster’s network is often too permissive: a compromised Pod may move laterally toward databases, management interfaces, and unrelated services on the same network. NetworkPolicy turns “network reachable” into an explicit declaration, reducing lateral movement and accidental access.

It is not a universal firewall replacement. Whether a policy is enforced depends on the cluster’s network plugin supporting NetworkPolicy; policies govern whether traffic is allowed, not identity authentication, encryption, or application-level authorization. Production rollout must validate policies against real dependencies such as DNS, metrics, logs, service meshes, and external egress.

The safest rollout is to map the communication matrix first, then isolate by namespace, Pod labels, and direction: observe, establish default denial, and finally allow only required paths. Every new gate should be tested against normal traffic, failure traffic, and operational traffic.

Metaphor mapping

• Linjiang’s three compounds — different namespaces and workloads in a cluster
• Wooden plaques on compounds and rooms — Pod and namespace labels
• Recognizing plaques, not faces — selector matching rather than concrete Pod names
• The gate controlling entry — an Ingress policy
• The gate controlling departure — an Egress policy
• Green-Tile House’s “courier” — an allowed source Pod
• A blank route sheet closing South Gate House — default denial after selecting a Pod
• Two plaques on one route — AND selectors within one rule
• Two routes at one gate — OR / additive allow behavior across policies
• The timekeeper and medicine depot — explicit DNS and service-discovery dependencies
• The stranger crossing all three compounds — lateral movement by a compromised workload