After applying a new NetworkPolicy in permits, a previously healthy web-to-api path starts timing out. Pods remain Ready. What should you check first?
Select an answer to reveal the explanation.
Short Explanation
New policy, sudden timeouts, Pods still green—classic “door locked, nobody on the allow list.” Start by reading who the policy selects and whether web clients and the right port are actually allowed. Don’t chase DNS restarts until the allow rules look right.
Full Explanation
When NetworkPolicies begin isolating Pods, traffic that used to flow freely is denied unless an allow rule matches. Timeouts with Ready Pods strongly suggest missing or mismatched ingress/egress allows for the client identity and port. NetworkPolicies do not require routine kube-dns restarts, do not zero replicas by themselves, and do not remove ClusterIP assignment from Services.