medium10 pts · first answer countskubernetesnetworkingsecurity

NetworkPolicy has no effect

You apply a default-deny ingress NetworkPolicy in a namespace, but Pods from other namespaces can still reach its Pods. The YAML is valid and the policy exists. What is the most likely cause?

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: payments
spec:
  podSelector: {}
  policyTypes: [Ingress]

A.NetworkPolicies only take effect for Pods created after the nodes have been drained and rebooted.B.The CNI plugin does not enforce NetworkPolicy, so the object is stored but never applied.C.podSelector: {} selects no Pods at all, so the policy never matches anything.D.Ingress policies only block traffic coming from outside the cluster, not from Pods.

← HPA shows unknown targets Node drain hangs forever →