Implement zero-trust security in K8s with network policies. Real YAML configs, Calico/Cilium examples, and production-tested deny-all patterns.