Cilium
Hard
Policies
In a CiliumNetworkPolicy, what does the entity 'world' match?
Select your answer:
Show answer and explanation
Answer: Everything outside the cluster, the same as allowing 0.0.0.0/0
Explanation
Entities name groups that labels can't describe. 'world' covers all endpoints outside the cluster, and allowing it is the same as allowing CIDR 0.0.0.0/0. Other entities include 'host' for the local node, 'remote-node' for the other nodes, 'cluster' for everything inside the cluster, 'kube-apiserver' and 'all'.
More hard Cilium questions
- An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?
- What does enabling Maglev consistent hashing in Cilium's kube-proxy replacement give you?
- What does Direct Server Return (DSR) mode change in Cilium's NodePort and LoadBalancer handling?
- How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?
- Which command lists only the flows that Cilium dropped, for example because of a network policy?
- How can you roll out a new Cilium network policy without risking dropped traffic?