App Pods are behind a default-deny ingress NetworkPolicy. External users reach the app through an Ingress controller. What additional allow is typically required?
Select an answer to reveal the explanation.
Short Explanation
The Ingress controller is just another client on the Pod network—default-deny means you must allow that controller's Pods to reach the app port. Opening all egress or hostNetwork doesn't invite that inbound knock.
Full Explanation
With default-deny ingress, traffic from Ingress controller Pods to backend Pods must be explicitly allowed via podSelector and/or namespaceSelector on the app NetworkPolicy. Controllers forward connections onto the Pod network, so egress-only allows or removing Services does not authorize that path. hostNetwork on app Pods is not the required fix.