Policy for Kubernetes services
Apply Calico policy to Kubernetes node ports
Restrict access to Kubernetes NodePort services using Calico Open Source GlobalNetworkPolicy at the host endpoint.
Apply Calico policy to services exposed externally as cluster IPs
Expose Kubernetes Service ClusterIPs over BGP using Calico Open Source and restrict who can reach them with network policy.