Question

A backend Deployment exposes a Pod with label app=payments listening on TCP 8080. Currently all traffic to these Pods is permitted. The security team requires that only Pods labeled role=frontend within the same namespace may reach the payments Pods, and only on port 8080. All other ingress must be blocked. Which NetworkPolicy correctly enforces this requirement?

Accepted Answer

A policy with podSelector matching app=payments, policyTypes: [Ingress], and an ingress rule with from: podSelector matching role=frontend and ports: [{protocol: TCP, port: 8080}]

Answer

A policy with podSelector matching role=frontend, policyTypes: [Ingress], and an ingress rule with from: podSelector matching app=payments and ports: [{protocol: TCP, port: 8080}]

Answer

A policy with podSelector matching app=payments, policyTypes: [Egress], and an egress rule with to: podSelector matching role=frontend and ports: [{protocol: TCP, port: 8080}]

Answer

A policy with an empty podSelector {}, policyTypes: [Ingress], and an ingress rule with from: podSelector matching role=frontend on port 8080