You have multiple services in your Kubernetes cluster, but you want only services labeled with `env=production` to receive IPs from the `production-pool` IP Pool. How should you configure the `production-pool` IP Pool to achieve this?
You have a Cilium-managed Kubernetes cluster where you want to allow endpoints labeled `role=frontend` to communicate with endpoints labeled `role=backend`. Which type of Layer 3 policy would you implement?
You have deployed Cilium's egress gateway in your Kubernetes cluster on AWS. However, some pod-to-pod traffic is exiting the cluster with the pod's own IP instead of the egress gateway's IP. What is the most likely cause based on Cilium's configuration guidelines?