How does the Container Network Interface (CNI) relate to Network Policies in Kubernetes?

How does the Container Network Interface (CNI) relate to Network Policies in Kubernetes?

• A. Network Policies are stored in etcd.
• B. Kubelet enforces policies.
• C. The CNI is responsible for implementing the rules defined in Network Policies.
• D. Network policies are optional.

Answer: (C)

The key idea is that Network Policies describe what traffic is allowed, but the actual enforcement happens through the CNI plugin. When you create a policy, Kubernetes stores the policy object, but it’s the CNI-enabled network plugin on each node that translates that policy into concrete firewall rules (such as iptables, nftables, or eBPF) to permit or deny traffic between pods. If the CNI plugin doesn’t support policy enforcement, those policies won’t be enacted. The Kubelet doesn’t enforce policies, and while policy objects are stored in etcd, enforcement is handled by the CNI.

The key idea is that Network Policies describe what traffic is allowed, but the actual enforcement happens through the CNI plugin. When you create a policy, Kubernetes stores the policy object, but it’s the CNI-enabled network plugin on each node that translates that policy into concrete firewall rules (such as iptables, nftables, or eBPF) to permit or deny traffic between pods. If the CNI plugin doesn’t support policy enforcement, those policies won’t be enacted. The Kubelet doesn’t enforce policies, and while policy objects are stored in etcd, enforcement is handled by the CNI.