You must connect to the correct host. Failure to do so may result in a zero score. Context You must implement NetworkPolicies controlling the traffic flow of existing Deployments across namespaces…

This question tests the ability to create Kubernetes NetworkPolicy objects to control ingress traffic between namespaces - a core CKA task involving namespace isolation and cross-namespace traffic rules.

Submitted by krish.m· May 4, 2026Runtime Security

Question

You must connect to the correct host. Failure to do so may result in a zero score.
Context
You must implement NetworkPolicies controlling the traffic flow of existing Deployments across namespaces.
Task
First, create a NetworkPolicy named deny-policy in the prod namespace to block all ingress traffic.
The prod namespace is labeled env:prod
Next, create a NetworkPolicy named allow-from-prod in the data namespace to allow ingress traffic only from Pods in the prod namespace.
Use the label of the prod namespace & Click to copy traffic.
The data namespace is labeled env:data
Do not modify or delete any namespaces or Pods. Only create the required NetworkPolicies.

Exhibit

Explanation

Approach. Create 'deny-policy' in the prod namespace with an empty podSelector (selects all pods) and policyTypes: [Ingress] with no ingress rules - this denies all inbound traffic to every pod in prod. Then create 'allow-from-prod' in the data namespace with an empty podSelector and an ingress rule using a namespaceSelector matching the label env: prod - this allows only pods from the prod namespace to send traffic into data. The critical detail is using namespaceSelector with matchLabels: {env: prod} (the namespace label, not a pod label) in the allow-from-prod policy. Both policies use podSelector: {} to target all pods in their respective namespaces.

Concept tested. Kubernetes NetworkPolicy - default-deny ingress patterns, namespaceSelector-based ingress rules, and the distinction between podSelector (targets pods within the policy's namespace) vs. namespaceSelector (restricts source namespace by label)

Reference. https://kubernetes.io/docs/concepts/services-networking/network-policies/

Topics

#NetworkPolicy#Kubernetes networking#Namespace isolation#Ingress rules

Community Discussion

No community discussion yet for this question.

Full CKS Practice