2V0-71.23 Question 169
Select 2You are a Kubernetes administrator managing a Tanzu Kubernetes Grid (TKG) cluster. A development team has requested that their application pods only communicate with each other within the same namespace and restrict all other external network traffic. Which network policy configuration would best fulfill this requirement?
- A
A network policy that allows ingress traffic from pods within the same namespace and denies all other ingress traffic.
- B
A network policy that allows egress traffic only to pods within the same namespace and denies all other egress traffic.
- C
A network policy that allows all ingress and egress traffic within the namespace.
- D
A network policy that denies all ingress and egress traffic by default and explicitly allows traffic within the same namespace.
- E
A network policy that allows ingress traffic from all namespaces but restricts egress traffic to the same namespace.
Show answer and explanation
Correct answers: A, B
Explanation
To restrict communication to only within the namespace, you need to define network policies that explicitly allow ingress and egress traffic within the namespace and deny all other traffic. Options 1 and 2 correctly address the requirements by limiting ingress and egress traffic to pods within the same namespace, ensuring that external communication is restricted.
- A. Correct.
This option is correct because allowing ingress traffic only from pods in the same namespace aligns with the requirement to restrict external communication while enabling internal communication.
- B. Correct.
This option is correct because allowing egress traffic only to pods within the same namespace is necessary to ensure that application pods can communicate internally but not externally.
- C. Incorrect.
This option does not meet the requirement because it allows all traffic within the namespace without applying restrictions to external communication.
- D. Incorrect.
This option is partially correct in concept but does not explicitly specify the required allowance for namespace-specific traffic, which could lead to blocked internal communication.
- E. Incorrect.
This option does not meet the requirement because it allows ingress traffic from all namespaces, which contradicts the need to restrict external communication.