A sanitation cluster wants to stop unrelated apps from talking east-west inside the same namespace without adopting CKS-only tooling. Which CKA-depth control fits?
Select an answer to reveal the explanation.
Short Explanation
For hallway isolation between apps, NetworkPolicy labels are the CKA-friendly fence — not headless Services or token automount flags.
Full Explanation
NetworkPolicy provides in-cluster micro-isolation by selecting Pods and allowing only specified peers and ports. That addresses east-west exposure at administrator depth without requiring specialized CKS hardening products. PodSecurity admission, headless Services, and ServiceAccount automount settings do not implement general TCP isolation between apps.