Question

A security engineer applies the following NetworkPolicy to the 'payments' namespace, which previously had no policies. Every pod in the namespace immediately stops receiving any incoming traffic, but pods can still make outbound connections normally.

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```

Why does all inbound traffic get blocked while outbound traffic is unaffected?

Accepted Answer

The empty podSelector selects all pods in the namespace, and because only Ingress is listed in policyTypes with no ingress rules, all ingress is denied while egress remains unrestricted.

Answer

An empty podSelector disables the CNI plugin for the namespace, which drops all packets until a matching label selector is added.

Answer

NetworkPolicies always block both ingress and egress by default, so outbound traffic would also stop once the CNI reconciles the rule.

Answer

The policy only affects pods created after it is applied, so existing pods lose ingress while new pods retain full connectivity.