<p>I have network policy created and implemented as per <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes" rel="nofollow noreferrer">https://github.com/ahmetb/kubernetes-network-policy-recipes</a>, and its working fidn , however I would like to understand how exactly this gets implemeneted in the back end , how does network policy allow or deny traffic , by modifying the iptables ? which kubernetes componenets are involved in implementing this ?</p>

<p>Network Policy is implemented by <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">network plugins</a> (calico for example) most commonly by setting up Linux Iptables Netfilter rules on the Kubernetes nodes.</p>

<p>From the docs <a href="https://docs.projectcalico.org/reference/architecture/data-path" rel="nofollow noreferrer">here</a></p>

<p>In the Calico approach, IP packets to or from a workload are routed and firewalled by the Linux routing table and iptables infrastructure on the workload’s host. For a workload that is sending packets, Calico ensures that the host is always returned as the next hop MAC address regardless of whatever routing the workload itself might configure. For packets addressed to a workload, the last IP hop is that from the destination workload’s host to the workload itself</p>

<p><a href="https://i.stack.imgur.com/9E8QO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9E8QO.png" alt="calico data path"></a></p>
