Question

In a shared namespace, you deploy a 'payments' pod that must only accept incoming traffic from pods labeled 'app=checkout'. All other pods in the cluster must be unable to reach 'payments'. The cluster uses a CNI plugin that supports NetworkPolicy. Which approach correctly enforces this requirement?

Accepted Answer

Create a NetworkPolicy that selects the 'payments' pods and defines an ingress rule with a podSelector matching 'app=checkout'.

Answer

Add the annotation 'networking.k8s.io/allow-from: app=checkout' to the 'payments' pod spec.

Answer

Create a Service of type ClusterIP for 'payments' and set its selector to 'app=checkout'.

Answer

Configure an RBAC Role that grants only 'checkout' pods permission to connect to 'payments'.