2V0-71.23 Question 168
Select 4You are managing a Kubernetes cluster deployed using VMware Tanzu and need to implement a network policy that restricts traffic to a critical application. The application runs in a namespace called 'finance' and should only allow incoming traffic from pods in the 'analytics' namespace. Which of the following steps are required to configure this network policy?
- A
Define a NetworkPolicy object in the 'finance' namespace to allow ingress traffic from the 'analytics' namespace.
- B
Set the 'policyTypes' field in the NetworkPolicy object to include 'Ingress'.
- C
Configure the NetworkPolicy to block all egress traffic by default.
- D
Use a 'namespaceSelector' in the 'from' field of the NetworkPolicy to specify the 'analytics' namespace.
- E
Ensure the cluster's CNI plugin supports Kubernetes NetworkPolicy.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To implement a network policy that restricts traffic to a specific namespace in Kubernetes using VMware Tanzu, you need to define a NetworkPolicy object in the namespace where the policy will be applied. The 'policyTypes' field must include 'Ingress' to restrict incoming traffic. Additionally, you can use a 'namespaceSelector' to specify allowed namespaces, such as 'analytics'. Lastly, the cluster's CNI plugin must support NetworkPolicy enforcement for the policy to be effective.
- A. Correct.
This is correct. A NetworkPolicy must be created in the namespace where traffic needs to be restricted or allowed, in this case, the 'finance' namespace.
- B. Correct.
This is correct. The 'policyTypes' field is required to specify whether the policy applies to ingress, egress, or both. Since the requirement is to restrict incoming traffic, 'Ingress' must be included.
- C. Incorrect.
This is incorrect. The scenario does not mention restricting egress traffic, so blocking all egress traffic is unnecessary in this case.
- D. Correct.
This is correct. A 'namespaceSelector' can be used in the NetworkPolicy to allow traffic from pods in a specific namespace, such as 'analytics'.
- E. Correct.
This is correct. Not all CNI plugins support NetworkPolicy enforcement, so it's crucial to verify the CNI plugin in use supports this feature.