A NetworkPolicy egress rule allows ipBlock.cidr: 10.0.0.0/8 but lists except: ["10.20.0.0/16"]. How should egress to 10.20.5.10 be treated relative to that rule?
Select an answer to reveal the explanation.
![To Create an exciting colorful infographic that explains the concepts in the question: Question: A NetworkPolicy egress rule allows ipBlock.cidr: 10.0.0.0/8 but lists except: ["10.20.0.0/16"]. How should egress to 10.20.5.10 be treated relative to that rule? Correct Answer: Traffic to 10.20.5.10 is not allowed by this ipBlock because it falls in the excepted range. Put EVERY visible label in double quotes. No people. No A/B/C/D letters. In one of the four corners put a little "Navy Duck".](/media/cncf/ckad/CKAD-e1-q252-infographic.webp)
Short Explanation
An except clause is like saying “the whole neighborhood is OK except that one cul-de-sac.” The /8 opens a big range, then except pulls 10.20.0.0/16 back out. 10.20.5.10 sits in that cul-de-sac, so this allow rule does not cover it.
Full Explanation
Within an ipBlock peer, cidr defines an allowed (or selected) IP range and except removes nested CIDRs from that selection. Destinations inside an excepted prefix are not matched by that ipBlock peer even though they sit inside the parent cidr. Except works for both ingress and egress peers; it is not limited to DNS and does not require a duplicate policy to take effect.