問題文
A security engineer writes a CiliumNetworkPolicy that allows traffic from pods labeled app=web to pods labeled app=api. The web deployment then scales from three replicas to thirty. A reviewer asks what the policy is actually matching on. Which statement is correct?
選択肢
- The rule matches on the name of the deployment, so renaming the deployment would silently disable the allowance.
- The rule matches on the service account of the pods.
- The rule matches an identity that is derived from the labels so every replica that carries the app=web label falls under exactly the same allowance.
- The rule is expanded into a list of the current pod addresses that is pushed to the nodes each time a replica appears.