"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
K3s enforces NetworkPolicy by default via its built-in kube-router controller. Yet traffic via LoadBalancer still leaked through — the cause was ServiceLB's implementation combined with a permanent limitation of the NetworkPolicy API. Here's how to detect and fix it.