2V0-71.23 Question 165
Single answerYou are managing a Kubernetes cluster deployed with VMware Tanzu and are tasked with restricting traffic between specific workloads within a namespace. The development team requests that a particular pod only allows incoming traffic on port 8080 from pods with the label app=frontend. Which type of Kubernetes object should you configure to enforce this requirement?
- A
NetworkPolicy
- B
PodSecurityPolicy
- C
Ingress
- D
ClusterRole
Show answer and explanation
Correct answer: A
Explanation
To restrict network communication between pods within a namespace, Kubernetes NetworkPolicies are utilized. These policies allow defining rules that specify which pods can communicate with others, as well as which ports are allowed for communication. In this scenario, a NetworkPolicy can be configured to permit only traffic on port 8080 from pods with the label app=frontend to the targeted pod.
- A. Correct.
NetworkPolicy is the correct Kubernetes object to define and enforce rules for allowing or denying network traffic between pods, including specifying allowed ports and selectors for traffic sources.
- B. Incorrect.
PodSecurityPolicy is used to enforce security-related settings at the pod level, such as privilege escalation and allowed volume types, but it does not control network traffic.
- C. Incorrect.
Ingress is used to manage HTTP and HTTPS traffic to services from outside the cluster, not within the cluster or between pods.
- D. Incorrect.
ClusterRole is used to define permissions for Kubernetes resources at the cluster level but has no relation to network traffic control.