Kubernetes
Hard
Security
In a NetworkPolicy ingress rule, what is the difference between putting namespaceSelector and podSelector in the same 'from' entry and putting them in two separate entries?
Select your answer:
Show answer and explanation
Answer: One entry means both must match (AND). Two entries mean either can match (OR)
Explanation
Inside a single 'from' entry the selectors combine, so the source must be a matching pod in a matching namespace. As separate list items, each one is its own allow rule: any pod in a matching namespace, or a matching pod in the policy's own namespace. One missing '-' in the YAML turns one form into the other, which is a common cause of policies that allow far more than intended.
More hard Kubernetes questions
- Two controllers read the same Deployment and both send an update based on what they read. How does the API server stop the second update from silently overwriting the first?
- A namespace has been stuck in Terminating for hours. What is the most likely cause?
- What does podManagementPolicy: Parallel change in a StatefulSet?
- What does volumeBindingMode: WaitForFirstConsumer on a StorageClass do?
- A slow-starting application is killed by its liveness probe before it finishes starting. What is the recommended fix?
- Which Pod Security Standards level requires pods to run as non-root, drop ALL capabilities, and use a seccomp profile?