Definition. A NetworkPolicy controls network traffic to and from pods based on label selectors, namespaces and IP blocks. Without a policy, a pod is not isolated. As soon as a policy with Egress selects it, only the outbound traffic allowed there is possible. The cluster's network plugin enforces it and must support NetworkPolicies.

Why it matters. An egress lock limits where a compromised process can send data. Against credential stealers from the supply chain it is therefore one of the most effective measures. The standard policy does not know host names; for that you need FQDN rules from your CNI, for example Cilium.

Example. The stealer in LiteLLM 1.107.0 sent its loot to www.litellm.dev. A proxy pod allowed to reach only its LLM providers and its database would have prevented the upload.

Related. Kubernetes, Admission policy, Supply chain attack