Question

A frontend Pod in the 'web' namespace must reach a backend Service in the 'api' namespace. You applied a default-deny egress NetworkPolicy to the 'web' namespace, then added a policy allowing egress to Pods labeled 'app=api' in the 'api' namespace on TCP 8080. The frontend can no longer resolve or reach the backend, and application logs show DNS lookup failures for the backend Service name. What must you add to restore connectivity while keeping egress restricted?

Accepted Answer

An egress rule allowing UDP and TCP port 53 to the kube-system namespace (CoreDNS) so name resolution can occur.

Answer

An ingress rule on the frontend Pod allowing traffic from the 'api' namespace on port 8080.

Answer

Change the backend Service type from ClusterIP to NodePort so it becomes reachable across namespaces.

Answer

Add 'ipBlock: 0.0.0.0/0' to the existing egress rule to permit all outbound traffic.