Kubernetes and Cloud Native Security Associate (KCSA) free question 5 / 10 · Domain 3: Kubernetes Security Fundamentals
Pod "api" is selected for ingress by two NetworkPolicies. Policy 1 allows traffic from Pods labelled role=web. Policy 2 allows traffic from Pods labelled role=batch. Which Pods in its namespace can connect to "api"?
- No Pods, because the two policies conflict and conflicting policies deny traffic.
- Just Pods labelled role=web, because Policy 1 was created before the role=batch one.
- Pods labelled role=web and Pods labelled role=batch, as the policies add up.
- Just the Pods that carry both labels, because each policy narrows the other one.
Show the answer and explanation
Answer: C
Why this is correct
A Pod is isolated for ingress once any NetworkPolicy that selects it has Ingress in its policyTypes. From then on, other Pods can connect to it only as far as the ingress list of some policy that applies to it allows. The page then says: "Network policies do not conflict; they are additive. If any policy or policies apply to a given pod for a given direction, the connections allowed in that direction from that pod is the union of what the applicable policies allow. Thus, order of evaluation does not affect the policy result." So both role=web and role=batch Pods may connect to "api"; neither policy takes anything away from the other.
Why the other options are wrong
"Just Pods labelled role=web, because Policy 1 was created before the role=batch one." … The page says the result is a union, "Thus, order of evaluation does not affect the policy result." Which policy came first does not matter.
"No Pods, because the two policies conflict and conflicting policies deny traffic." … "Network policies do not conflict; they are additive." Two policies selecting the same Pod each add allowed connections.
"Just the Pods that carry both labels, because each policy narrows the other one." … The page describes the opposite of narrowing: "The effects of those ingress lists combine additively." A Pod needs to match one policy's rule, not all of them.
NetworkPolicies only add
There is no precedence and no conflict between NetworkPolicies. What a Pod may receive is the union of all policies that select it.