delete networkpolicies

Deleting a NetworkPolicy removes namespace isolation, opening lateral movement between previously segmented workloads.

A pod is only isolated while some policy selects it.

Enforcement is a property of the CNI, so on a plugin that implements no policy there was never isolation to remove.

Escalation Paths

Delete the NetworkPolicy that isolates the target workload.
A pod is only isolated while some policy selects it.
Once the last selecting policy is gone, the pod accepts traffic from anywhere again.
Where another policy still selects the pod, deletion narrows nothing and the remaining policy keeps enforcing.
Previously unreachable workloads become reachable for lateral movement, and monitoring that relied on the policy blocking traffic sees nothing change.
Enforcement is implementation defined, so confirm the CNI actually implements NetworkPolicy before treating its removal as a change in reachability

Additional rights needed:

none