Cluster: qa-cluster Master node: master Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context qa-cluster Task: Crea

Question

Explanation

This task tests your ability to create a Kubernetes NetworkPolicy that restricts ingress traffic to a specific Pod using namespace selectors and pod label selectors. You must combine two ingress rules: one allowing all pods from a specific namespace, and another allowing pods with a specific label from any namespace.

Approach. Apply kubectl config use-context qa-cluster first, then create a NetworkPolicy in the dev namespace targeting pods labeled app: products-service (or whatever label selector matches the products-service pod). The policy needs two ingress rules under from: (1) a namespaceSelector matching kubernetes.io/metadata.name: qa to allow all pods from the qa namespace, and (2) a podSelector with matchLabels: {environment: stage} combined with an empty namespaceSelector: {} to allow pods with that label from ANY namespace. Rule (2) requires BOTH podSelector and namespaceSelector: {} in the same from array entry - using separate entries would create an OR condition per entry, but placing both selectors within a single - list item creates an AND condition (pod must have the label AND be in a matching namespace). The policyTypes field must include Ingress.

Concept tested. Kubernetes NetworkPolicy ingress rules - specifically the difference between list-item AND logic (same - entry with both namespaceSelector + podSelector) versus OR logic (separate - entries), and how to restrict pod-to-pod communication using namespace and label selectors.

Reference. https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors

No community discussion yet for this question.