Key capabilities
- Require both source egress and destination ingress when isolated
- Evaluate matchLabels, matchExpressions, namespace selectors and ipBlock
- Compare every supplied Pod pair at the chosen port
- Resolve Service selectors and target ports to backend Pods
