2V0-71.23 Question 167
Select 3Your organization is deploying a multi-tenant Kubernetes cluster managed by VMware Tanzu. As part of the security requirements, you need to restrict network traffic so that workloads in one namespace can only communicate with specific external services and cannot communicate with workloads in other namespaces. Which of the following actions should you take to achieve this objective?
- A
Create a NetworkPolicy in each namespace to explicitly allow ingress traffic only from specific external IPs and deny all other ingress traffic.
- B
Define a default-deny ingress rule in the NetworkPolicy for each namespace, and add specific egress rules to allow traffic to trusted external services.
- C
Use an Ingress resource to control the allowed external services and deny all other ingress traffic.
- D
Configure a NetworkPolicy in each namespace to deny all egress traffic by default and allow egress only to trusted external services.
- E
Implement a Kubernetes RoleBinding to restrict communication between namespaces.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enforce network isolation and restrict communication between namespaces, you need to configure Kubernetes NetworkPolicies. A combination of explicit ingress and egress rules, along with default-deny policies, ensures workloads are restricted to specific external services and isolated from other namespaces. NetworkPolicies are the appropriate tool for controlling traffic flows in Kubernetes, whereas RoleBindings and Ingress resources do not fulfill the stated requirements.
- A. Correct.
Correct: Creating a NetworkPolicy with ingress rules for each namespace ensures that only specific external IPs are allowed while denying other ingress traffic. This aligns with the requirement of restricting ingress communication.
- B. Correct.
Correct: Adding a default-deny ingress rule ensures that no traffic is allowed unless explicitly permitted. Adding specific egress rules for trusted external services fulfills the requirement of restricting communication to trusted external destinations.
- C. Incorrect.
Incorrect: An Ingress resource is designed to handle HTTP/HTTPS traffic entering the cluster, not for internal or namespace-to-namespace communication policies. It cannot fulfill the requirement for restricting namespace communication.
- D. Correct.
Correct: Denying all egress traffic by default and allowing egress only to trusted external services ensures that workloads cannot communicate with other namespaces or unauthorized external endpoints.
- E. Incorrect.
Incorrect: Kubernetes RoleBindings control access to Kubernetes API resources and do not impose networking restrictions between namespaces. This does not address the requirements in the scenario.