# Reflection: Reachability and Trust Are Decisions You Make on Purpose

You just applied default-deny NetworkPolicy, egress restriction, TLS ingress, and image-pull
authentication for real. Take a few minutes to connect these to a single underlying principle.

## Reflection questions

1. Four different mechanisms in this module (NetworkPolicy ingress, NetworkPolicy egress, TLS,
   image-pull secrets) all express the same underlying idea in a different layer. What is that
   idea, stated in one sentence?
2. If you had to prioritize implementing ONLY ONE of this module's controls on a brand-new,
   unsecured cluster, which would you pick first, and why?
3. How would you explain, to someone who thinks "our cluster is internal, so it doesn't need
   this," why internal-only still benefits from all four controls?

## Real Ops takeaway

**Trust should be explicit, narrow, and verifiable — never assumed from proximity.** A Pod on
the same cluster, a request from inside the corporate network, an image from "a registry we
usually use" — none of these are actually trustworthy by default. Every control in this module
replaces an assumption ("it's internal, it's probably fine") with an explicit, checkable
decision (this specific Pod can reach this specific destination; this specific registry is
authenticated; this specific connection is encrypted).

**Supply-chain and network security compound.** A compromised image with unrestricted egress on
an open network is a far worse incident than the same compromised image on a hardened one — the
controls in this module don't individually prevent every incident, but together they
dramatically shrink what any single failure can turn into.

This module is complete. Continue to the next module.

## Instructor Notes

**Discussion questions for a live classroom:** question 1 is the module's thesis — make sure
students can actually articulate it in their own words, not just recognize it when stated.

**Approximate timing:** 8-10 minutes live discussion; 5 minutes self-paced writing.

**Optional extension:** ask students to rank this module's four controls by how much
IMPLEMENTATION EFFORT each typically requires on a real team, separately from security value —
a good exercise in real-world prioritization tradeoffs.