Question

Your team runs a set of application pods labeled 'app=payments' in the 'prod' namespace. Security requires that these pods be allowed to send traffic ONLY to an external database at CIDR 10.50.0.0/24 on port 5432, and to no other destinations. Currently there are no NetworkPolicies in the namespace, so all egress is permitted. Which approach correctly enforces this requirement?

Accepted Answer

Create a NetworkPolicy selecting 'app=payments' with policyTypes including Egress, and a single egress rule allowing 'to' the 10.50.0.0/24 ipBlock on TCP port 5432.

Answer

Create a NetworkPolicy selecting 'app=payments' with policyTypes including Ingress, and an ingress rule allowing traffic from 10.50.0.0/24 on TCP port 5432.

Answer

Create a NetworkPolicy with an empty podSelector and an egress rule allowing all pods to reach 10.50.0.0/24, relying on kube-proxy to drop other traffic.

Answer

Add a firewall annotation to the payments Deployment specifying the allowed CIDR and port, which the kubelet will translate into egress rules.