Question

In the namespace 'payments', a security engineer applies the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Before this policy, all Pods in 'payments' could freely receive traffic from any source. After applying it, other teams report that Pods in 'payments' are no longer reachable. What is the effect of this policy?

Accepted Answer

It selects all Pods in the 'payments' namespace and, because no ingress rules are specified, denies all inbound traffic to those Pods.

Answer

It has no effect because an empty podSelector matches no Pods, so traffic continues as before.

Answer

It allows all ingress traffic to every Pod in 'payments' since no ingress rules restrict specific sources.

Answer

It denies all ingress and egress traffic for Pods in 'payments' because policyTypes defaults to both directions.