Problem Statement
Which control helps stop container breakout paths that rely on calling external endpoints?
Explanation
Limit outbound so a compromised pod cannot freely reach metadata, unknown hosts, or exfil paths. Allow only the domains your app needs.
Code Solution
SolutionRead Only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
podSelector: {}
policyTypes: [Egress]
egress:
- to:
- namespaceSelector: { matchLabels: { name: dns } }