Update the Pod ckad00018-newpod in the ckad00018 namespace to use a NetworkPolicy allowing the Pod to send and receive traffic only to and from the pods web and db

Question

Exhibits

Explanation

The task requires creating a Kubernetes NetworkPolicy to restrict a specific Pod's ingress and egress traffic solely to other Pods identified by 'web' and 'db' labels.

Approach. The correct interaction involves creating a YAML definition for a Kubernetes NetworkPolicy and applying it to the cluster using kubectl.

1. Set Context (if not already): The exhibit shows kubectl config use-context k8s. In an exam, this might be a preliminary step or already configured.
2. Identify Pod Labels: Since NetworkPolicy uses podSelector to target pods by labels, the first step is to identify the labels of the ckad00018-newpod pod. A common command would be kubectl get pod ckad00018-newpod -n ckad00018 -o yaml. For the purpose of this explanation, we assume the pod ckad00018-newpod has the label app: ckad00018-newpod, and the web and db pods have labels app: web and app: db respectively, as is standard practice in such scenarios.
3. Create NetworkPolicy YAML: Create a file (e.g., newpod-policy.yaml) with the following content:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: ckad00018-newpod-restrict-policy
     namespace: ckad00018 # Policy must be in the same namespace as the pod
   spec:
     podSelector:
       matchLabels:
         app: ckad00018-newpod # Selects the target pod to apply the policy to
     policyTypes:
       - Ingress # Apply rules for incoming traffic
       - Egress  # Apply rules for outgoing traffic
     ingress:
       - from:
         - podSelector:
             matchLabels:
               app: web # Allow ingress from pods with label app: web
         - podSelector:
             matchLabels:
               app: db  # Allow ingress from pods with label app: db
     egress:
       - to:
         - podSelector:
             matchLabels:
               app: web # Allow egress to pods with label app: web
         - podSelector:
             matchLabels:
               app: db  # Allow egress to pods with label app: db
   

4. Apply NetworkPolicy: Apply the created YAML file using kubectl apply -f newpod-policy.yaml.

Common mistakes.

• common_mistake. 1. Incorrect podSelector: Using a podSelector that does not match the actual labels of ckad00018-newpod, web, or db pods will result in the policy not being applied or not functioning as intended. Always verify actual pod labels (kubectl get pod <pod-name> -o yaml).

1. Missing or Incorrect policyTypes: If policyTypes is omitted or only one of Ingress or Egress is specified when both are needed, the policy will either not apply correctly or will only restrict one direction of traffic, leaving the other unrestricted. The question explicitly states 'send and receive traffic'.
2. Wrong Namespace: NetworkPolicies are namespace-scoped. Creating the policy in a different namespace than ckad00018 will mean it won't apply to ckad00018-newpod.
3. Incorrect Rule Structure: Mistakes in the YAML structure, such as placing podSelector directly under ingress or egress instead of within from or to clauses, or misconfiguring the matchLabels for the web and db pods, will lead to a non-functional policy.
4. Forgetting Default Deny: Once a NetworkPolicy targets a pod, all traffic not explicitly allowed by that policy (or other policies also targeting the pod) is implicitly denied. Assuming traffic will flow if not explicitly denied is a common misunderstanding once a policy is in place.

Concept tested. Kubernetes NetworkPolicies, including their structure (apiVersion, kind, metadata, spec), how to use podSelector to target specific pods and define allowed communication sources/destinations, specifying policyTypes (Ingress, Egress), and understanding the declarative 'default deny' behavior when a policy is applied.

No community discussion yet for this question.