PART A -- Deny ALL ingress traffic in prod namespace. Requirement: NetworkPolicy name: deny-policy, Namespace: prod (namespace is labeled env=prod), Effect: block all ingress.

1) Connect to the correct host ssh cks000031 sudo -i 2) Use admin kubeconfig export KUBECONFIG=/etc/kubernetes/admin.conf 3) Create deny-policy in prod Create the policy directly with kubectl! (fastest & safest): cat <<EOF | kubectl apply -f - apiVersion: networking.k8s.io/v1 kin

Submitted by minji_kr· May 4, 2026Cluster Hardening

Question

PART A -- Deny ALL ingress traffic in prod namespace. Requirement: NetworkPolicy name: deny-policy, Namespace: prod (namespace is labeled env=prod), Effect: block all ingress.

Explanation

Connect to the correct host ssh cks000031

sudo -i

Use admin kubeconfig export KUBECONFIG=/etc/kubernetes/admin.conf
Create deny-policy in prod Create the policy directly with kubectl! (fastest & safest):

cat <<EOF | kubectl apply -f - apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-policy namespace: prod spec: podSelector: {} policyTypes: - Ingress EOF

What this does: podSelector: {} -> selects all Pods in prod No ingress: rules -> deny all ingress traffic

Verify kubectl -n prod get networkpolicy deny-policy

Topics

#Kubernetes NetworkPolicy#Ingress control#Network security#Namespace isolation

Community Discussion

No community discussion yet for this question.

Full CKS Practice