How can you roll out a new Cilium network policy without risking dropped traffic?

Select your answer:

A.Create the policy with spec.action: DryRun and watch the logs
B.Apply it as a Kubernetes NetworkPolicy, which Cilium only logs
C.Give it an empty endpointSelector so it selects nothing yet
D.Turn on policy audit mode and watch for AUDIT verdicts

Show answer and explanation

Answer: Turn on policy audit mode and watch for AUDIT verdicts

Explanation

Policy audit mode, set cluster-wide with policyAuditMode or per endpoint, makes Cilium allow traffic it would otherwise drop and report those flows with the AUDIT verdict. Watch them with 'hubble observe --verdict AUDIT', adjust the policy until nothing unexpected shows up, then turn audit mode off. Note that Cilium does enforce standard Kubernetes NetworkPolicies.

Take the Expert Cilium quiz All Cilium levels

You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?
Which of these is required to connect two clusters with Cilium ClusterMesh?
How do you make a Service load-balance across all clusters in a Cilium ClusterMesh?
How does Cilium's Bandwidth Manager enforce the kubernetes.io/egress-bandwidth annotation on a pod?
Which Cilium resource defines the IP ranges that Cilium hands out to Services of type LoadBalancer?
You install Cilium with kubeProxyReplacement=true on a cluster without kube-proxy. Why do you have to set k8sServiceHost and k8sServicePort?

How can you roll out a new Cilium network policy without risking dropped traffic?

Select your answer:

Explanation

More hard Cilium questions