Question 1 of 7
Several NetworkPolicies select the same destination Pod. One policy has an empty ingress list while another explicitly allows the required source and port. How do you determine the effective traffic result, and what must also be true on the source Pod?
Strong Interview Answer
Kubernetes NetworkPolicies are additive, not ordered, so an empty-ingress policy does not override a separate matching allow rule. For Pod-to-Pod traffic, the union of applicable destination ingress rules must allow the connection and, if the source is isolated for egress, the union of its applicable egress rules must also allow it. I would also verify that the installed CNI actually enforces NetworkPolicy.
What to Listen For
- policies are additive and order-independent
- empty ingress isolates but does not override other allows
- source egress and destination ingress must both allow
- label selectors and ports must match
- CNI enforcement must exist
Caution
Reject answers that treat policies like firewall rules evaluated top-to-bottom or assume a deny policy overrides an allow policy.