 it a large amount of flexibility in processing, and allows it to be
distributed (and upgraded!) in a container.</p><p>Network Policy data plane is typically implemented in kernel space (e.g. using iptables, eBPF filters, or even custom kernel modules). Being in kernel space
allows them to be extremely fast, but not as flexible as the Envoy proxy.</p><h2 id=enforcement-point>Enforcement point</h2><p>Policy enforcement using the Envoy proxy is implemented inside the pod, as a sidecar container in the same ne