Kubernetes network policies: your cluster is flat until you say otherwise

Here's a fact that surprises people new to Kubernetes and should genuinely alarm them a little: by default, every pod in your cluster can talk to every other pod, unrestricted, regardless of namespace...