Here's a fact that surprises people new to Kubernetes and should genuinely alarm them a little: by default, every pod in your cluster can talk to every other pod, unrestricted, regardless of namespace, regardless of what the two pods actually do. Your carefully separated services, your isolated namespaces, all of that organizational structure means nothing to the network unless you explicitly tell Kubernetes to enforce it. Network policies are how you actually do that, and most clusters are running without them.
The default is flat, and flat means one compromised pod can reach everything. Without network policies, the entire pod network is one big open space, any pod can initiate a connection to any other pod on any port, cluster-wide. This means that if an attacker compromises a single pod, maybe through a vulnerable dependency, a misconfigured service, whatever the entry point, they can potentially reach every other pod in your cluster from that one foothold, regardless of namespace boundaries that look like isolation on paper but do nothing to actually restrict network traffic. Namespaces organize your resources. They do not, by themselves, segment your network.
A network policy is basically a firewall rule scoped to pods. At its core, a network policy specifies which pods can talk to which other pods, on which ports, and in which direction, ingress traffic coming in, egress traffic going out. You define it declaratively, the same way you define everything else in Kubernetes, and the cluster's networking layer enforces it. The concept maps directly onto ordinary network segmentation, just expressed in pod selectors and labels instead of IP ranges.
