CKA Services and Networking Practice Question
You want to configure NetworkPolicy to allow ingress traffic only from pods with label 'role: frontend' in the same namespace. Which podSelector should be in the ingress rule?
⚠ Common exam trap
A common mix-up: candidates confuse `spec.podSelector` (which selects the target pods the policy applies to) with the `podSelector` inside `ingress.from` (which selects the source pods allowed to send traffic), leading them to pick Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
podSelector in spec.ingress.from
In a Kubernetes NetworkPolicy, the `spec.ingress.from` field specifies the sources allowed to send ingress traffic. To match pods with a specific label within the same namespace, you use a `podSelector` under `from`. This selects pods based on their labels, and since no `namespaceSelector` is specified, it defaults to the same namespace as the NetworkPolicy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
podSelector in spec.podSelector
Why it's wrong here
The spec.podSelector field selects the pods that the policy applies to, meaning it identifies the destinations that will be subject to the ingress rules. It does not define which sources are allowed to connect; it is the scope of the policy, not the origin of traffic. For allowing ingress from specific pods, you must put a podSelector inside the ingress rule's from array, not in the top-level spec.podSelector.
- ✓
podSelector in spec.ingress.from
Why this is correct
Within an ingress rule, the from field accepts one or more sources, and a podSelector there selects the exact source pods whose traffic to the selected destination pods will be permitted. This is the core mechanism for allowing ingress from specific pods, as it matches pods by labels in the same namespace unless combined with a namespaceSelector. Without this field, the ingress rule has an empty from, which means no sources are allowed, aligning with the default-deny behavior.
- ✗
podSelector in spec.egress.to
Why it's wrong here
The spec.egress.to field appears in egress rules, which govern outbound traffic initiated by the pods selected in spec.podSelector. Placing a podSelector there defines allowed destinations for outgoing connections, not sources for inbound requests, so it has no effect on ingress traffic. Since the goal is to allow a specific set of clients to reach the selected pods, this option addresses the wrong direction of network flow.
- ✗
namespaceSelector in spec.ingress.from
Why it's wrong here
namespaceSelector in spec.ingress.from matches entire namespaces by their labels, not individual pods, so it would allow all pods from those namespaces to connect, lacking pod-level granularity. Although this is a valid way to permit ingress from namespace-wide sources, it does not use a podSelector and is therefore not the correct answer to a question specifically asking for pod-level selection. In practical use, you would pair this with a podSelector to narrow the allowed source pods within the selected namespace.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.