Answer
CNI plugins enforce policies using iptables or eBPF based on Pod labels.
Quick Answer
NetworkPolicies are enforced by the CNI plugin (not kube-proxy or the kernel directly). The CNI plugin (Calico, Cilium, Weave) watches NetworkPolicy objects via the API server and programs iptables, eBPF, or OVS rules on each node accordingly. By default, no NetworkPolicies means all traffic is allowed — policies are additive restrictions.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ