2V0-71.23 Question 166
Select 3You are tasked with securing a Tanzu Kubernetes cluster by implementing a network policy that restricts traffic between pods. The policy should allow pods in the 'frontend' namespace to communicate with pods in the 'backend' namespace on port 80 but deny all other traffic. Which of the following statements about Kubernetes network policies are correct and relevant to this scenario?
- A
Network policies are namespaced, so you need to define separate policies for each namespace involved.
- B
To allow traffic between 'frontend' and 'backend', the policy must specify both ingress and egress rules.
- C
The default behavior of a cluster without any network policies is to deny all traffic between pods.
- D
A network policy applies to all pods in the cluster, regardless of their namespace.
- E
When no network policies are applied, all pods in a namespace can communicate with each other by default.
Show answer and explanation
Correct answers: A, B, E
Explanation
Kubernetes network policies are used to control traffic at the pod level. They are defined within namespaces, so separate policies are required for each namespace involved in communication. By default, all pods within a namespace can communicate unless a policy restricts it. To allow traffic between pods in different namespaces, both ingress and egress rules must be configured properly. Understanding these principles is crucial for securing a Tanzu Kubernetes cluster.
- A. Correct.
Correct. Kubernetes network policies are namespaced, meaning you need to define policies for the 'frontend' and 'backend' namespaces separately to achieve the desired traffic flow restriction.
- B. Correct.
Correct. To allow communication between two namespaces (frontend to backend), both ingress (for backend) and egress (for frontend) rules are required in the network policy.
- C. Incorrect.
Incorrect. By default, clusters without network policies allow unrestricted traffic between pods. Traffic is not denied by default unless explicitly configured.
- D. Incorrect.
Incorrect. Network policies are scoped to a particular namespace and do not apply cluster-wide unless explicitly implemented in the same way across all namespaces.
- E. Correct.
Correct. When no network policies are defined, Kubernetes allows unrestricted communication between pods within the same namespace.