How to: Network policies
There are two kinds of Pod isolation: isolation for egress (outbound), and isolation for ingress (inbound). By default, all ingress and egress traffic is allowed to and from pods in a namespace, until you have a [NetworkPolicy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) in that namespace.

Network policies are implemented by a [_network plugin_](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/). A _NetworkPolicy_ will have no effect if a _network plugin_ that supports _NetworkPolicy_ is not installed in the cluster.

There are [three different identifiers](https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors) that controls entities that a Pod can communicate with:

- `podSelector`: selects pods within the _NetworkPolicy_ namespace allowed for ingress/egress using _selector_ matching (note: a pod cannot block itself)
- `namespaceSelector`: selects all pods in specific namespaces allowed for ingress/egress using _selector_ matching
- `ipBlock`: selects IP CIDR ranges (cluster-external IPs) allowed for ingress/egress (note: node traffic is always allowed - not for CKAD)

```sh
minikube stop
minikube delete