The three-layer defense principle is: reject bad traffic as early and as cheaply as possible, and assume that every layer will occasionally miss. Blocking at the edge costs nothing, blocking at the load balancer costs little, requests reaching the Pod cost the most, and the runtime layer is the last line of defense.