Oracle explicitly states that virtual nodes do not support Kubernetes NetworkPolicy resources or network providers such as Calico and Cilium that provide NetworkPolicy enforcement. Virtual nodes support only OCI VCN-Native Pod Networking and cannot use Flannel or other third-party CNI plugins. By contrast, Calico can be installed with managed node pools while retaining VCN-native pod networking. This combination enables Kubernetes NetworkPolicy objects to enforce pod-level traffic controls and micro-segmentation. An IAM policy or network security list cannot substitute for Kubernetes NetworkPolicy because OCI network controls and Kubernetes pod policy enforcement operate at different layers. Therefore, when Calico-based NetworkPolicy enforcement is mandatory, migrating the workload from virtual nodes to managed node pools is the supported OKE architecture.