<p>I have network policy created and implemented as per <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes" rel="nofollow noreferrer">https://github.com/ahmetb/kubernetes-network-policy-recipes</a>, and its working fidn , however I would like to understand how exactly this gets implemeneted in the back end , how does network policy allow or deny traffic , by modifying the iptables ? which kubernetes componenets are involved in implementing this ?</p>

<p>"It depends". It's up to whatever controller actually does the setup, which is usually (but not always) part of your CNI plugin.</p>

<p>The most common implementation is Calico's <a href="https://github.com/projectcalico/felix" rel="nofollow noreferrer">Felix daemon</a>, which supports several backends, but iptables is a common one. Other plugins use eBPF network programs or other firewall subsystems to similar effect.</p>
