Study. uk . com
  1. Home
  2. All questions
  3. Question 763

CKA study material · question 763 of 1000

Why does the documentation say ipBlock should name cluster-external addresses?

  1. Pod addresses are ephemeral and unpredictable
  2. ipBlock rules are only evaluated on egress
  3. CNI plugins ignore ipBlock for in-cluster traffic
  4. Pod addresses are always translated before policy evaluation
Show the answer

Answer: A. Pod addresses are ephemeral and unpredictable

Pod addresses change as Pods are rescheduled, so a CIDR rule aimed at them is unreliable; in-cluster peers are selected with pod and namespace selectors instead.

Source: Network Policies (Kubernetes) — Behavior of to and from selectors

Challenge yourself on this topic → Study as cards