There Is No Deny Rule: Isolation, Policy, and Upgrades on a Shared Cluster
Granting edit in a namespace grants every identity in it. A network policy with no plugin behind it does nothing, and the API will not tell you which.
-
-
Network Policy
Policies are additive with no deny rules, both ends of a connection must allow it, and a default-deny egress rule blocks DNS until you allow that too.