Which component is critical for enforcing network policies at the node level in Kubernetes?

Which component is critical for enforcing network policies at the node level in Kubernetes?

• A. Kubelet
• B. Container Network Interface (CNI) plugin
• C. DNS service (CoreDNS)
• D. Docker daemon

Answer: (B)

Enforcing network policies at the node level is handled by the CNI plugin. Kubernetes NetworkPolicy objects define what traffic should be allowed or blocked, but the actual enforcement happens through the CNI plugin on each node. The plugin configures the node’s networking stack (iptables, eBPF, or similar) to permit or deny traffic between pods and to external endpoints according to the policy. The Kubelet is responsible for starting pods and setting up their networking via the CNI, but it doesn’t enforce policies by itself. CoreDNS deals with name resolution, not traffic policies, and the Docker daemon is just the container runtime; policy enforcement is implemented by the CNI, not the runtime.

Enforcing network policies at the node level is handled by the CNI plugin. Kubernetes NetworkPolicy objects define what traffic should be allowed or blocked, but the actual enforcement happens through the CNI plugin on each node. The plugin configures the node’s networking stack (iptables, eBPF, or similar) to permit or deny traffic between pods and to external endpoints according to the policy. The Kubelet is responsible for starting pods and setting up their networking via the CNI, but it doesn’t enforce policies by itself. CoreDNS deals with name resolution, not traffic policies, and the Docker daemon is just the container runtime; policy enforcement is implemented by the CNI, not the runtime.