Kubetier
← Permission Reference
T2

delete networkpolicies

Deleting a NetworkPolicy removes namespace isolation, opening lateral movement between previously segmented workloads.

Policies that block monitoring traffic create blind spots for defenders.

API Group
networking.k8s.io
Scope
namespaced
Audit Level
RequestResponse

Escalation Paths

  1. Delete the NetworkPolicy that isolates the target workload.

  2. A pod is only isolated while some policy selects it.

    Once the last selecting policy is gone, the pod accepts traffic from anywhere again.

  3. Where another policy still selects the pod, deletion narrows nothing and the remaining policy keeps enforcing.

  4. Previously unreachable workloads become reachable for lateral movement, and monitoring that relied on the policy blocking traffic sees nothing change.

Additional rights needed:

none
K8s docs ↗
K8s docs ↗