Cilium
Hard
Policies
What is wrong with a Cilium egress rule that lists both toFQDNs and toEndpoints?
Select your answer:
Show answer and explanation
Answer: A toFQDNs rule can't contain other L3 selectors such as toEndpoints
Explanation
Cilium's documentation states that toFQDNs egress rules can't contain other L3 rules such as toEndpoints or toCIDR. They may contain toPorts with L4 and L7 rules. Put the DNS rule to kube-dns and the toFQDNs rule in separate entries of the same egress list.
More hard Cilium questions
- What is the purpose of Cilium's egress gateway feature?
- What is the purpose of Cilium's 'prefilter' feature?
- In Cilium's tunnel mode (VXLAN or Geneve), how does the receiving node learn the security identity of a packet sent by a pod on another node?
- A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?
- How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?
- With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?