Cilium
Hard
Security
You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?
Select your answer:
Show answer and explanation
Answer: A CiliumClusterwideNetworkPolicy with a nodeSelector, with the host firewall enabled
Explanation
Host policies protect the node, not pods. They must be CiliumClusterwideNetworkPolicies that use nodeSelector instead of endpointSelector, and the host firewall must be enabled (hostFirewall.enabled=true). Start with audit mode on the host endpoint, because a mistake can cut off SSH or kubelet traffic.
More hard Cilium questions
- Which of these is required to connect two clusters with Cilium ClusterMesh?
- How do you make a Service load-balance across all clusters in a Cilium ClusterMesh?
- How does Cilium's Bandwidth Manager enforce the kubernetes.io/egress-bandwidth annotation on a pod?
- Which Cilium resource defines the IP ranges that Cilium hands out to Services of type LoadBalancer?
- You install Cilium with kubeProxyReplacement=true on a cluster without kube-proxy. Why do you have to set k8sServiceHost and k8sServicePort?
- In Cilium's default cluster-pool IPAM mode, what assigns each node its pod CIDR?