Review the Cilium Network Policy in the YAML file.

Technical explanation

The policy’s endpointSelector selects the ship workload in the namespace containing the CiliumNetworkPolicy , which is ns-cca . It also explicitly includes io.cilium.k8s.policy.cluster: cluster1 , confirming that the selected source endpoint belongs to cluster1.

The egress rule authorizes communication to an endpoint carrying name: base and the cluster label io.cilium.k8s.policy.cluster: cluster2 . Because the namespaced policy does not specify a different destination namespace through k8s:io.kubernetes.pod.namespace , the intended destination is the corresponding base workload in ns-cca on cluster2. Therefore, A matches the policy.

Options C and D incorrectly describe the rule as a deny rule. Cilium policy rules use an allow-list model unless an explicit egressDeny or ingressDeny section is present. The exhibit contains an ordinary egress rule, so matching traffic is authorized. Option B incorrectly places the destination in default .

Current Cilium versions require explicit cluster targeting for remote endpoints, which this policy provides through the cluster label.

Official references

Cluster Mesh Network Policy , Namespaces in Cilium Policy

Study Guide topic: Cluster Mesh labels, namespaced policies, and cross-cluster endpoint selection.