networkpolicy without a cni that implements it does nothing. the api server accepts your default-deny, enforcement is zero, traffic flows anyway. the silent failure.

test it: two pods, two namespaces, confirm the connection is actually refused. if it isn't refused, your policy is decorative.

https://rajesh.medampudi.com/blog/multi-tenant-infra-small-team

#kubernetes #security #selfhosting #devops