<p>Suppose I have 2 network policies, for nodes matching labels "app=database". Suppose:</p>

<ul>
<li>First policy has rules that block all ingress traffic.</li>
<li>Second policy has a rule allows ingress traffic on port 5660.</li>
</ul>

<p>Even though this is a simple example, how does kubernetes decides which rule wins?
In more complex scenarios with several overlapping rules maybe covering similar pods, how would this be managed? E.g.: can we define priorities in Network policies?</p>

<p>Thanks.</p>

<p>Kubernetes network policies right now does not allow <em>deny</em> policies. There are only <em>allow</em> policies. You basically put together all the allowed policies for the pod to get the allowed connections.</p>

<p>When there are one or more network policies on a pod, then all the connections   <em>allowed by at least one of the network policies</em>, will be allowed.</p>

<p>So how does the default deny works. It just tells that the allowed connections are none.</p>

<p>A more detailed explanation is available <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#isolated-and-non-isolated-pods" rel="noreferrer" title="this">here</a>.</p>
