You can switch the cluster/configuration context using the following command: [desk@cli]$ kubectl config use-context dev A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace

Question

Explanation

This task tests your ability to implement a Kubernetes default-deny NetworkPolicy that blocks all Ingress and Egress traffic for every Pod in a given namespace. It validates understanding of how an empty podSelector and empty rule lists create a blanket traffic block.

Approach. Switch context first with kubectl config use-context dev. Then edit the skeleton at /home/cert_masters/network-policy.yaml to set metadata.name: deny-network, metadata.namespace: test, an empty podSelector: {} (which matches ALL pods in the namespace), and policyTypes: [Ingress, Egress] with NO corresponding ingress: or egress: rule blocks. The absence of rule blocks under a declared policyType is what makes it a deny-all. Apply with kubectl apply -f /home/cert_masters/network-policy.yaml. The resulting manifest is:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-network
  namespace: test
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

This selects every Pod (podSelector: {}) and declares both traffic directions are policy-controlled, but provides zero allow rules - so all traffic is implicitly denied.

Concept tested. Kubernetes NetworkPolicy default-deny pattern: using an empty podSelector to target all Pods in a namespace, declaring both Ingress and Egress in policyTypes, and intentionally omitting ingress/egress rule blocks to achieve a blanket deny effect.

Reference. https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-and-all-egress-traffic

No community discussion yet for this question.