Cilium
Hard
Policies
With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?
Select your answer:
Show answer and explanation
Answer: As soon as any policy with an ingress section selects the pod
Explanation
In the default mode, an endpoint that no policy selects allows all traffic. Once a policy with ingress rules selects it, ingress becomes default-deny and only the listed peers get through. Egress is handled separately in the same way. The 'always' mode makes every endpoint default-deny even without a policy, and 'never' turns enforcement off.
More hard Cilium questions
- In a CiliumNetworkPolicy, what does the entity 'world' match?
- An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?
- What does enabling Maglev consistent hashing in Cilium's kube-proxy replacement give you?
- What does Direct Server Return (DSR) mode change in Cilium's NodePort and LoadBalancer handling?
- How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?
- Which command lists only the flows that Cilium dropped, for example because of a network policy?