Question

An application team runs Pods labeled app=payments in the checkout namespace. A cluster-wide default-deny egress policy is already in place. The Pods must be able to connect to an external payment gateway at IP 203.0.113.50 on TCP port 443, but must not be able to reach any other external destination. DNS resolution via CoreDNS (kube-system) is already permitted by a separate policy. Which NetworkPolicy correctly grants only the required egress?

Accepted Answer

A policy with podSelector matching app=payments, policyTypes: [Egress], and an egress rule with 'to: [{ipBlock: {cidr: 203.0.113.50/32}}]' and 'ports: [{protocol: TCP, port: 443}]'.

Answer

A policy with podSelector matching app=payments, policyTypes: [Egress], and an egress rule with 'to: [{ipBlock: {cidr: 203.0.113.0/24}}]' and 'ports: [{protocol: TCP, port: 443}]'.

Answer

A policy with podSelector matching app=payments, policyTypes: [Ingress], and an ingress rule with 'from: [{ipBlock: {cidr: 203.0.113.50/32}}]' and 'ports: [{protocol: TCP, port: 443}]'.

Answer

A policy with an empty podSelector ({}), policyTypes: [Egress], and an egress rule with 'to: [{ipBlock: {cidr: 203.0.113.50/32}}]' and 'ports: [{protocol: TCP, port: 443}]'.