Question

A DevSecOps team runs a microservices application on a Kubernetes cluster. By default, all pods can communicate freely with each other across namespaces. Security wants to enforce that only the frontend pods may initiate connections to the payment-service pods, while blocking all other lateral pod-to-pod traffic to that service. Which Kubernetes-native mechanism should the team implement to achieve this least-privilege pod communication?

Accepted Answer

Configure a NetworkPolicy resource with pod and namespace selectors defining allowed ingress to the payment-service pods

Answer

Assign RBAC Roles and RoleBindings restricting which service accounts can call the payment-service API

Answer

Apply a PodSecurityPolicy (or Pod Security Standard) enforcing a restricted profile on the payment-service pods

Answer

Enable a ResourceQuota on the payment namespace to cap the number of concurrent connections