Frontend Pods labeled app=frontend must reach backend Pods labeled…

Question

Frontend Pods labeled app=frontend must reach backend Pods labeled app=backend on TCP 8080. Which NetworkPolicy approach allows that ingress?

Accepted Answer

Select the backend Pods and allow ingress from podSelector app=frontend on port 8080. — NetworkPolicy ingress is "who may knock on these Pods' doors." Select the backend, allow from the frontend podSelector on 8080. RBAC and HTTP Ingress objects don't replace that packet allow.

Answer

Select the frontend Pods and deny all egress; backends will still accept frontend traffic automatically.

Answer

Create only an Ingress resource with path /backend; NetworkPolicies are unused for Pod-to-Pod TCP.

Answer

Label the Service account and rely on RBAC RoleBindings to authorize Pod network packets.

Frontend Pods labeled app=frontend must reach backend Pods labeled app=backend on TCP 8080. Which NetworkPolicy approach allows that ingress?

Short Explanation

Full Explanation