Operators apply a NetworkPolicy that selects all Pods in a namespace and allows no ingress peers. What is the effective result until allow rules are added?
Select an answer to reveal the explanation.
Short Explanation
An empty "guest list" NetworkPolicy is a velvet rope—selected Pods get no inbound visitors until you add allow rules. It isn't cluster-wide, and it isn't waiting on an Ingress object.
Full Explanation
A NetworkPolicy that selects Pods and specifies ingress policy with no allowed sources effectively default-denies inbound traffic to those Pods. Isolation is limited to selected Pods in that namespace, not the whole cluster. Ingress API objects are unrelated, and empty ingress allow lists do not leave ingress open when Ingress is a listed policyType.