Question

Your company runs a multi-tenant GKE Standard cluster where several teams deploy workloads into the same cluster but in separate namespaces. Security has mandated that pods in the 'payments' namespace must only accept ingress traffic from pods in the 'frontend' namespace, and all other pod-to-pod traffic to 'payments' must be denied by default. The cluster currently has no traffic restrictions between pods. What should you do to enforce this requirement?

Accepted Answer

Enable Dataplane V2 (or Calico) network policy enforcement on the cluster, then create a Kubernetes NetworkPolicy in the 'payments' namespace with a default-deny ingress rule plus an allow rule selecting pods from the 'frontend' namespace.

Answer

Create VPC firewall rules that deny traffic between the pod IP ranges and add an allow rule for the frontend pod range, using network tags on the nodes.

Answer

Configure Google Cloud Armor security policies attached to the payments workload's internal load balancer to filter traffic by source namespace.

Answer

Place the 'payments' and 'frontend' workloads in separate node pools and rely on node-level firewall rules to isolate the payments node pool from all other pods.