Question

A security engineer applies two separate NetworkPolicy objects to the pods labeled app=payments in the same namespace. Policy A allows ingress from pods labeled role=frontend, and Policy B allows ingress from pods labeled role=monitoring. A colleague worries that having two policies will cause a conflict where only one set of traffic is permitted. What is the actual effect on ingress traffic to the payments pods?

Accepted Answer

Traffic is allowed if it matches Policy A OR Policy B, so both frontend and monitoring pods can reach the payments pods.

Answer

Traffic must satisfy Policy A AND Policy B simultaneously, so only pods labeled both role=frontend and role=monitoring are allowed.

Answer

The most recently applied policy overrides the earlier one, so only monitoring pods can reach the payments pods.

Answer

Having two policies targeting the same pods is invalid, and the API server rejects the second policy.