patch networkpolicies

Patching an existing NetworkPolicy opens ingress or egress holes while the object stays in place.

This is subtler than deletion, since it may not trigger alerts, and a single rule change can expose services that were isolated.

Escalation Paths

Create a second NetworkPolicy selecting the same pods, with an unconditional allow rule for ingress or egress.
Allowed traffic is the union of every policy that selects the pod, so the permissive rule reopens what the restrictive policy closed.
The restrictive policy is untouched and still present, so an audit or GitOps diff of existing objects shows it intact.
Patching an existing policy reaches the same result by adding allow rules or by narrowing its podSelector so it stops selecting the target.
Quieter than deletion, because nothing that was there is missing.
The new object is the only evidence.

Additional rights needed:

none