Google Professional Cloud Network Engineer Question 325
Single answerGoogle Cloud PlatformYou have deployed a GKE cluster to host a microservices-based application. To ensure secure communication between pods, you need to create a GKE NetworkPolicy that allows ingress traffic only from pods in the same namespace with the label 'app: frontend' to pods with the label 'app: backend'. Which of the following YAML definitions correctly implements this NetworkPolicy?
- A
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend ingress:
- from:
- podSelector: matchLabels: app: frontend
- from:
- B
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend ingress:
- from:
- namespaceSelector: matchLabels: app: frontend
- podSelector: matchLabels: app: frontend
- from:
- C
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend ingress:
- from:
- podSelector: matchLabels: app: frontend
- namespaceSelector: matchLabels: app: backend
- from:
- D
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend ingress:
- from:
- podSelector: matchLabels: app: frontend policyTypes:
- Ingress
- from:
Show answer and explanation
Correct answer: A
Explanation
The correct NetworkPolicy must allow ingress traffic only from pods with the label 'app: frontend' to pods with the label 'app: backend' in the same namespace. Option 1 correctly implements this by specifying a podSelector matching 'app: backend' and restricting ingress sources to pods with the label 'app: frontend'. Other options either introduce unnecessary configurations or fail to meet the requirement.
- A. Correct.
This option correctly defines a NetworkPolicy where ingress traffic is allowed only from pods with the label 'app: frontend' to pods with the label 'app: backend'. The podSelector matches the 'app: backend' pods, and the 'from' section restricts traffic to sources matching the 'app: frontend' label within the same namespace.
- B. Incorrect.
This option incorrectly includes a namespaceSelector, which is unnecessary for this scenario since the requirement specifies traffic within the same namespace. Including a namespaceSelector can lead to unintended behavior.
- C. Incorrect.
This option incorrectly includes a namespaceSelector with a label 'app: backend', which is not relevant to restricting traffic from 'app: frontend' pods to 'app: backend' pods. This could also cause configuration errors.
- D. Incorrect.
This option incorrectly adds 'policyTypes: Ingress' without any functional impact since ingress is already the default policy type. However, it does not match the exact requirement of the question and may lead to confusion.