NIST SP 800-190 SP800-190-3.10: Network Segmentation Between Pods

What does SP800-190-3.10 require?

Limit pod to pod communication using network policies that follow a default deny model. Allow only the flows that the application requires, including egress, so a compromised pod cannot pivot freely across the cluster.