Ingress and egress rules in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Kubernetes Ingress Purpose

What is the primary purpose of an Ingress resource in Kubernetes?

A To schedule pods on specific nodes based on resource availability

B To define firewall rules for controlling outbound traffic from pods

C To manage persistent storage volumes for stateful applications

D To control external access to services inside the cluster, typically HTTP and HTTPS routes

💡 Hint

Think about how users outside the cluster reach your applications.

Ingress manages external HTTP/S access to services inside the cluster by defining routing rules.

💻 Command Output

intermediate

Output of kubectl get ingress

What is the output of the command kubectl get ingress when no Ingress resources exist in the default namespace?

Kubernetes

kubectl get ingress

A

NAME   HOSTS   ADDRESS   PORTS   AGE

B Error from server (NotFound): ingresses.networking.k8s.io "" not found

C No resources found in default namespace.

D

NAME   HOSTS   ADDRESS   PORTS   AGE
my-ingress   *   192.168.1.1   80   5d

💡 Hint

Consider what Kubernetes shows when no matching resources exist.

The command returns a message indicating no ingress resources are found in the namespace.

❓ Configuration

advanced

Egress Rule to Allow Outbound HTTP Traffic

Which NetworkPolicy YAML snippet correctly allows pods in the frontend label group to send outbound HTTP (port 80) traffic to any destination?

A

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http-egress
spec:
  podSelector:
    matchLabels:
      role: frontend
  policyTypes:
  - Egress
  egress:
  - ports:
    - protocol: TCP
      port: 80

B

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http-egress
spec:
  podSelector:
    matchLabels:
      role: frontend
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP
      port: 80

C

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http-egress
spec:
  podSelector:
    matchLabels:
      role: frontend
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: UDP
      port: 80

D

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http-egress
spec:
  podSelector:
    matchLabels:
      role: frontend
  policyTypes:
  - Egress
  egress:
  - ports:
    - protocol: TCP
      port: 443

💡 Hint

Remember that egress rules control outbound traffic and HTTP uses TCP port 80.

Option A correctly defines an egress rule allowing TCP traffic on port 80 from pods labeled role=frontend.

❓ Troubleshoot

advanced

Diagnosing Ingress Not Routing Traffic

You created an Ingress resource, but external HTTP requests to your domain return 404 errors. Which is the most likely cause?

A The pod labels do not match the Service selector

B The Ingress controller is not installed or running in the cluster

C The Service type is set to ClusterIP instead of LoadBalancer

D The NetworkPolicy blocks all ingress traffic to the pods

💡 Hint

Think about what component handles Ingress routing.

If the Ingress controller is missing or not running, Ingress rules won't be applied, causing 404 errors.

✅ Best Practice

expert

Best Practice for Securing Egress Traffic in Kubernetes

Which approach is considered best practice to secure egress traffic from pods in a Kubernetes cluster?

A Use NetworkPolicies to explicitly allow only required outbound traffic and deny all else by default

B Allow all egress traffic by default and rely on pod security policies for protection

C Configure Ingress resources to filter outbound traffic from pods

D Use host firewall rules only, ignoring Kubernetes NetworkPolicies

💡 Hint

Think about the principle of least privilege for network access.

Explicitly allowing only necessary egress traffic with NetworkPolicies reduces attack surface and is best practice.