A housing GenAI Kubernetes namespace has no network policies, so any pod can reach the vector database. What control is missing?
Select an answer to reveal the explanation.
Short Explanation
No network policies means every pod has a backstage pass to the vector DB. Lock east-west paths to what actually needs GenAI data. HostPort to Wi-Fi, killing kube-proxy, and stuffing embeddings into ConfigMaps are not that lock.
Full Explanation
A housing GenAI Kubernetes namespace without network policies allows any pod to reach the vector database, creating unconstrained east-west access to a civic GenAI data store. The missing control is network policies—or service-mesh equivalents—that restrict which workloads can reach municipal GenAI data stores. Only retrieval and augmented-generation pods plus approved operators should speak to the vector database on its ports; random apps in the namespace must be denied by default.
Publishing the vector database via HostPort to campus Wi-Fi broadcasts a sensitive store onto a broad audience and bypasses cluster service isolation. Disabling kube-proxy to make east-west traffic unpredictable harms reliability without providing intentional, auditable isolation. Storing embeddings only in ConfigMaps is an inappropriate data pattern for vector content and does not implement network isolation to a proper datastore.
Exam caveat: network policies require a CNI that enforces them; declaring YAML without an enforcing plugin is theater and will not stop pod-to-vector traffic. Operational check: apply deny-by-default in the housing GenAI namespace, allowlist specific pod selectors to the vector database service, verify a random pod cannot open connections to the embeddings endpoint, and monitor policy-deny metrics.