Study. uk . com
  1. Home
  2. All questions
  3. Question 761

CKA study material · question 761 of 1000

A Pod is isolated for ingress by a policy that names no peers. The kubelet's liveness probe still succeeds. Why?

  1. Probes bypass the network stack entirely
  2. Connections from the Pod's own node are still permitted
  3. The kubelet is exempt from all NetworkPolicies by RBAC
  4. Probes are sent through the API server, which is always allowed
Show the answer

Answer: B. Connections from the Pod's own node are still permitted

Even under ingress isolation, connections from the Pod's node are allowed alongside whatever the ingress rules permit, which is what keeps kubelet probes working.

Source: Network Policies (Kubernetes) — The two sorts of pod isolation

Challenge yourself on this topic → Study as cards