https://blog.landryzetam.net/tags/networkpolicy/Recent content in NetworkPolicy on Landry Zetam - Tech BlogHugo -- gohugo.ioen-usThu, 11 Jun 2026 00:00:00 +0000https://blog.landryzetam.net/posts/network-policy-vs-authorization-policy/Thu, 11 Jun 2026 00:00:00 +0000https://blog.landryzetam.net/posts/network-policy-vs-authorization-policy/<p>Kubernetes gives you two resources that both look like &ldquo;firewall rules for pods,&rdquo; and most teams deploy one and assume they got the other for free. They didn&rsquo;t. The two policies operate at different layers, speak different languages, and fail in completely different ways — and you almost certainly need both.</p> <h2 id="the-setup">The Setup</h2> <p>Picture a cluster running a service mesh (Istio, in my case) with a typical three-tier layout: an ingress gateway, a handful of API services, and a PostgreSQL database listening on port 5432. The security requirement sounds simple: only the API services should reach the database, and only the gateway should reach the APIs. The first instinct is to reach for <em>a</em> policy — and Kubernetes hands you two that both claim to do this. <code>NetworkPolicy</code> ships with Kubernetes itself (enforced by your CNI — Cilium, Calico). <code>AuthorizationPolicy</code> ships with Istio (enforced by the Envoy sidecar). Same goal on paper, very different machinery underneath.</p>