Question

A namespace called 'payments' currently has no NetworkPolicies. A team applies a first policy 'deny-all' with an empty podSelector (selecting all pods) and an empty ingress rule set (no rules). Later they apply a second policy 'allow-frontend' that selects pods with label 'app=api' and allows ingress from pods labeled 'app=frontend' on port 8080. After both policies exist, which statement correctly describes the resulting ingress behavior for a pod labeled 'app=api'?

Accepted Answer

Traffic from 'app=frontend' pods to port 8080 is allowed; all other ingress to the 'app=api' pod is denied, because policies are additive (union of allowed traffic).

Answer

All ingress to the 'app=api' pod is denied, because the 'deny-all' policy was applied first and takes precedence over later policies.

Answer

All ingress to the 'app=api' pod is allowed, because the 'allow-frontend' policy overrides the earlier 'deny-all' policy.

Answer

Traffic is allowed only if it matches both policies simultaneously, so 'app=frontend' pods must also satisfy the empty ingress rules of 'deny-all'.