A city cluster must isolate Pods in the finance namespace so that,…

Question

A city cluster must isolate Pods in the finance namespace so that, by default, no other Pods can reach them until explicit allow rules are added. Which NetworkPolicy approach achieves that default-deny posture for selected Pods?

Accepted Answer

Apply a NetworkPolicy that selects the finance Pods and defines an empty ingress rule set (or equivalent deny-all ingress) so only later allow rules reopen traffic. — Default-deny is like locking every office door first, then handing out keys with allow rules — empty/deny ingress on a NetworkPolicy selects who starts locked.

Answer

Create a ClusterRole with no verbs; API authorization automatically drops east-west TCP packets.

Answer

Set every Service type to ExternalName so ClusterIP traffic is rejected by kube-proxy.

Answer

Delete CoreDNS ConfigMaps so unresolved names act as a network deny-all.

A city cluster must isolate Pods in the `finance` namespace so that, by default, no other Pods can reach them until explicit allow rules are added. Which NetworkPolicy approach achieves that default-deny posture for selected Pods?

Short Explanation

Full Explanation