Which component is essential for enforcement of NetworkPolicies in Kubernetes?

Which component is essential for enforcement of NetworkPolicies in Kubernetes?

• A. Kube-Proxy
• B. Container Network Interface (CNI) plugin
• C. CoreDNS
• D. API Server

Answer: (B)

NetworkPolicy enforcement in Kubernetes happens in the network data plane, powered by the CNI plugin. NetworkPolicy objects declare what traffic is allowed between pods, but you need a CNI that implements those rules on each node to actually enforce them. The CNI plugin translates the policy into concrete network rules (using iptables, eBPF, or similar mechanisms) and applies them at the node level, so only permitted traffic passes between pods. Kube-proxy handles service networking and load balancing for ClusterIP/NodePort, not pod-to-pod network policy enforcement. CoreDNS provides name resolution for services, not traffic filtering. The API Server stores and serves the NetworkPolicy resources, but enforcement happens in the data plane by the CNI plugin.

NetworkPolicy enforcement in Kubernetes happens in the network data plane, powered by the CNI plugin. NetworkPolicy objects declare what traffic is allowed between pods, but you need a CNI that implements those rules on each node to actually enforce them. The CNI plugin translates the policy into concrete network rules (using iptables, eBPF, or similar mechanisms) and applies them at the node level, so only permitted traffic passes between pods.

Kube-proxy handles service networking and load balancing for ClusterIP/NodePort, not pod-to-pod network policy enforcement. CoreDNS provides name resolution for services, not traffic filtering. The API Server stores and serves the NetworkPolicy resources, but enforcement happens in the data plane by the CNI plugin.