A network policy must restrict backend access to approved callers. What is required for enforcement?

1. Only a YAML comment describing the rule
2. Only a matching image tag
3. Only a namespace with a restrictive name
4. A network implementation supporting NetworkPolicy