Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in…

Question

Exhibit

Explanation

The task requires creating a Kubernetes NetworkPolicy YAML definition to restrict ingress traffic to port 9000 for pods in the 'echo' namespace, allowing connections only from pods within the 'my-app' namespace.

Approach. The correct interaction involves creating a YAML file (e.g., networkpolicy.yaml) within the provided terminal, defining the NetworkPolicy resource as specified, and then applying it to the Kubernetes cluster.

Steps:

1. Open a text editor in the terminal: vim networkpolicy.yaml
2. Insert the following YAML content into the file:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: allow-port-from-namespace
     namespace: echo
   spec:
     podSelector: {}
     policyTypes:
       - Ingress
     ingress:
       - from:
           - namespaceSelector:
               matchLabels:
                 kubernetes.io/metadata.name: my-app
         ports:
           - protocol: TCP
             port: 9000
   

3. Save the file and exit the editor (e.g., Esc, :wq).
4. Apply the NetworkPolicy using kubectl apply -f networkpolicy.yaml.

Reasoning for the YAML:

• apiVersion: networking.k8s.io/v1 and kind: NetworkPolicy define the resource type.
• metadata.name: allow-port-from-namespace sets the required name.
• metadata.namespace: echo ensures the policy applies to pods within the echo namespace.
• podSelector: {} makes the policy apply to all pods within the echo namespace (the target pods).
• policyTypes: - Ingress explicitly enables ingress rules for this policy.
• ingress: block defines the incoming traffic rules.
• from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: my-app specifies that only traffic originating from pods in the namespace labeled my-app (typically kubernetes.io/metadata.name is used by default for namespace names) is allowed.
• ports: - protocol: TCP port: 9000 restricts the allowed ingress traffic to TCP port 9000, ensuring access is not allowed to other ports.

Common mistakes.

• common_mistake. Several common mistakes can lead to an incorrect solution:

1. Missing policyTypes: [Ingress]: Without this, the ingress rules will not be enforced, and the NetworkPolicy will effectively allow all ingress traffic (if no egress rules are present and policyTypes is omitted, policyTypes defaults to Ingress if ingress is specified and Egress if egress is specified. However, explicitly defining policyTypes is best practice and prevents ambiguity).
2. Incorrect podSelector: If podSelector is too restrictive (e.g., podSelector: { matchLabels: { app: some-app } }) and doesn't match all desired target pods in the echo namespace, the policy won't apply to all intended pods. Using {} applies to all pods in the policy's namespace.
3. Incorrect namespaceSelector: Using podSelector within the from block instead of namespaceSelector, or using incorrect labels for the my-app namespace, would fail to correctly identify the source pods.
4. Omitting ports or incorrect port: If the ports section is omitted from the ingress rule, all ports would be allowed, violating the constraint to only allow port 9000. Specifying the wrong port number would also be incorrect.
5. Wrong metadata.namespace: Creating the NetworkPolicy in a namespace other than echo would make it ineffective for the intended target pods.

Concept tested. Kubernetes NetworkPolicies, specifically creating an ingress rule to control traffic flow based on source namespace and target port, using namespaceSelector and ports within the ingress section, and understanding the role of podSelector and policyTypes.

Reference. https://kubernetes.io/docs/concepts/services-networking/network-policies/

No community discussion yet for this question.