How do NetworkPolicies behave when multiple policies are applied to a set of pods in Kubernetes?

How do NetworkPolicies behave when multiple policies are applied to a set of pods in Kubernetes?

• A. They are additive and cumulative in effect
• B. They override each other with the most restrictive rule
• C. They create independent segments that do not interact
• D. They are mutually exclusive and cannot co-exist

Answer: (B)

When multiple NetworkPolicies target the same pods, their effects are combined. The allowed ingress and egress are the union of all rules from the policies that select the pod. This means traffic is permitted if it matches at least one policy’s rule, and traffic not covered by any policy is denied. So adding more policies can broaden or refine what’s allowed, but there’s no “most restrictive” override mechanism. If no policy selects a pod, traffic is allowed by default; once policies apply, only traffic that matches any policy is allowed. For example, if one policy allows ingress from a specific namespace and another allows ingress from a certain IP, traffic from either source is allowed.

When multiple NetworkPolicies target the same pods, their effects are combined. The allowed ingress and egress are the union of all rules from the policies that select the pod. This means traffic is permitted if it matches at least one policy’s rule, and traffic not covered by any policy is denied. So adding more policies can broaden or refine what’s allowed, but there’s no “most restrictive” override mechanism. If no policy selects a pod, traffic is allowed by default; once policies apply, only traffic that matches any policy is allowed. For example, if one policy allows ingress from a specific namespace and another allows ingress from a certain IP, traffic from either source is allowed.