You write a NetworkPolicy, apply it to a namespace, and move on. Nobody tests it. Nobody validates it against the actual traffic the service depends on. It sits there until a deploy breaks something, and the first sign of trouble is a pod that can't reach its database.
Most teams treat NetworkPolicies like documentation instead of code. Someone writes one, a reviewer skims the YAML, it gets merged, and it goes straight onto the cluster. There's no equivalent of a unit test for "can pod A talk to pod B on port 5432." That gap is where the 2am pages come from.
Here are three tools that close it, plus a CI setup that catches a bad rule before merge instead of during an incident.
Why NetworkPolicy bugs are hard to catch by reading YAML
A NetworkPolicy looks simple. Selectors, ports, ingress and egress rules. But three things make them easy to get wrong:
