<p>I have a deny all by default policy across all pods in all namespaces. What if there is allow all added to a pod in a certain namespace. What will take precedence? Is there any and / or logic when combing multiple policies?</p>

<p>Thanks</p>

user1578872
<p>It's not entirely clear from what I've found but <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#isolated-and-non-isolated-pods" rel="nofollow noreferrer">the documentation</a> hints at any <em>allow</em> taking precendence over <em>deny</em>:</p>

<blockquote>
  <p>Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. (Other pods in the namespace that are not selected by any NetworkPolicy will continue to accept all traffic.)</p>
</blockquote>

<p>Basically, applying a NetworkPolicy to any pod includes an implicit "deny anything else" policy. By creating a "default deny" policy you are able to isolate all pods as they're not targeted by any policy without it (no policy = no isolation). </p>
