AZ-500 Question 121
Select 2You operate a production AKS cluster hosting multiple microservices. Due to compliance requirements, pods in the 'private-services' namespace must only accept inbound traffic from pods in the 'frontend' namespace, and they must not send outbound traffic to the public internet. Which of the following actions should you take to enforce these requirements? (Choose two.)
- A
Enable Azure RBAC for Kubernetes authorization to restrict user access rather than inter-pod traffic.
- B
Create a Kubernetes Network Policy that allows inbound traffic from the 'frontend' namespace to 'private-services' and denies other inbound traffic.
- C
Deploy a dedicated node pool for 'private-services' pods and attach a custom NSG to block all outbound traffic at the node level.
- D
Use a Kubernetes Network Policy to deny all egress from 'private-services' except DNS if required.
Show answer and explanation
Correct answers: B, D
Explanation
To effectively isolate pod-to-pod traffic and restrict outbound internet access within an AKS environment, you use Kubernetes Network Policies. They allow you to define fine-grained rules at the namespace and pod levels. Option 2 enforces the inbound isolation by only allowing traffic from the 'frontend' namespace to 'private-services'. Option 4 enforces the outbound restriction by denying all egress traffic from 'private-services', except for DNS if required. For more details and best practices, refer to Microsoft's official documentation on Kubernetes Network Policies in Azure Kubernetes Service: https://learn.microsoft.com/azure/aks/use-network-policies.
- A. Incorrect.
Option 1: This configures role-based access for administrative operations, not network isolation. It does not regulate traffic between pods or namespaces, so it is incorrect for the stated requirements.
- B. Correct.
Option 2: A Kubernetes Network Policy can specifically permit traffic from the 'frontend' namespace and deny other inbound sources. This is correct and achieves the inbound isolation requirement.
- C. Incorrect.
Option 3: Although placing pods on a dedicated node pool and applying a custom NSG can limit traffic at a subnet level, this approach does not provide fine-grained namespace-level isolation. Network Policies are more targeted for inter-pod traffic restrictions. Consequently, it is not the most correct choice here.
- D. Correct.
Option 4: A Kubernetes Network Policy that denies egress traffic from 'private-services', allowing only DNS if necessary, prevents outbound access to external resources. This satisfies the egress restriction requirement.