Question

A team deploys the 'payments' application into the 'finance' namespace. Security requires that pods in 'finance' may only send traffic to other pods within the same namespace, while continuing to resolve DNS via CoreDNS in kube-system. All other egress must be blocked. The CNI plugin fully supports NetworkPolicy. Which NetworkPolicy configuration correctly enforces this?

Accepted Answer

A single policy with policyTypes: [Egress], an empty podSelector, one egress rule with a 'to' entry using podSelector: {} (no namespaceSelector), plus an egress rule allowing UDP/TCP port 53 to the kube-system namespace.

Answer

A single policy with policyTypes: [Egress], an empty podSelector, and one egress rule with a 'to' entry combining namespaceSelector: {} and podSelector: {} to match all pods everywhere.

Answer

A single policy with policyTypes: [Ingress], an empty podSelector, and one ingress rule allowing traffic from podSelector: {} within the namespace.

Answer

A single policy with policyTypes: [Egress] and an empty podSelector and no egress rules, relying on the default DNS allowance built into Kubernetes.