From 445020674e0892d9fbd2c70bb2f6f38b0f4c04bd Mon Sep 17 00:00:00 2001 From: Sam Darwin Date: Mon, 4 Nov 2019 17:12:10 -0600 Subject: [PATCH] Update network-policies.md (#17335) * Update network-policies.md Add explanation of policy evaluation order from https://github.com/kubernetes/kubernetes/issues/75435 * edit text in network-policies.md --- .../en/docs/concepts/services-networking/network-policies.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/concepts/services-networking/network-policies.md b/content/en/docs/concepts/services-networking/network-policies.md index 81682f13cd..5c085bcddc 100644 --- a/content/en/docs/concepts/services-networking/network-policies.md +++ b/content/en/docs/concepts/services-networking/network-policies.md @@ -28,6 +28,8 @@ By default, pods are non-isolated; they accept traffic from any source. Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. (Other pods in the namespace that are not selected by any NetworkPolicy will continue to accept all traffic.) +Network policies do not conflict, they are additive. If any policy or policies select a pod, the pod is restricted to what is allowed by the union of those policies' ingress/egress rules. Thus, order of evaluation does not affect the policy result. + ## The `NetworkPolicy` Resource See the [NetworkPolicy](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#networkpolicy-v1-networking-k8s-io) for a full definition of the resource.