Ingress and egress rules in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow incoming HTTP traffic on port 80 in a Kubernetes NetworkPolicy.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http
spec:
  podSelector: {}
  ingress:
  - ports:
    - protocol: TCP
      port: [1]

Drag options to blanks, or click blank then click option'

A443

B8080

C22

D80

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 443 which is for HTTPS.

Using port 22 which is for SSH.

Port 80 is the standard port for HTTP traffic, so it must be specified to allow HTTP ingress.

2fill in blank

medium

Complete the code to allow egress traffic to TCP port 53 for DNS resolution.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
spec:
  podSelector: {}
  egress:
  - ports:
    - protocol: TCP
      port: [1]

Drag options to blanks, or click blank then click option'

A53

B80

C443

D22

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 80 or 443 which are for HTTP/HTTPS.

Using port 22 which is for SSH.

Port 53 is used for DNS queries, so allowing egress on TCP port 53 enables DNS resolution.

3fill in blank

hard

Fix the error in the NetworkPolicy to correctly specify ingress from pods with label app=frontend.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-ingress
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: [1]

Drag options to blanks, or click blank then click option'

Abackend

Bfrontend

Cdatabase

Dcache

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong label values like backend or database.

Misspelling the label value.

The label 'app: frontend' matches pods with the frontend role, allowing ingress from them.

4fill in blank

hard

Fill both blanks to allow egress traffic only to pods with label role=database on TCP port 5432.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-db-egress
spec:
  podSelector: {}
  egress:
  - to:
    - podSelector:
        matchLabels:
          role: [1]
    ports:
    - protocol: TCP
      port: [2]

Drag options to blanks, or click blank then click option'

Adatabase

Bfrontend

C5432

D80

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong label like frontend.

Using port 80 which is for HTTP.

Pods with label 'role: database' are targeted, and port 5432 is the default port for PostgreSQL database connections.

5fill in blank

hard

Fill all three blanks to create an ingress rule allowing TCP traffic on port 443 only from pods with label tier=frontend in namespace 'web'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-https-from-frontend
spec:
  podSelector: {}
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: [1]
      podSelector:
        matchLabels:
          tier: [2]
    ports:
    - protocol: TCP
      port: [3]

Drag options to blanks, or click blank then click option'

Aweb

Bfrontend

C443

Dbackend

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong namespace or pod labels.

Using port 80 instead of 443.

The namespace label 'web' restricts source namespaces, 'tier: frontend' restricts pods, and port 443 is for HTTPS traffic.

Practice

1. What do Ingress rules control in Kubernetes NetworkPolicies?

easy

A. CPU resource limits for pods

B. Incoming traffic to pods

C. Storage access for pods

D. Outgoing traffic from pods

Solution

1. Step 1: Understand the role of Ingress rules

   Ingress rules specify which incoming network traffic is allowed to reach the pods.

2. Step 2: Differentiate from Egress rules

   Egress rules control outgoing traffic, not incoming.

3. Final Answer:

   Incoming traffic to pods -> Option B

4. Quick Check:

   Ingress = Incoming traffic [OK]

Hint: Ingress means incoming traffic control [OK]

Common Mistakes:

• Confusing ingress with egress
• Thinking ingress controls resource limits
• Mixing network traffic with storage access

2. Which of the following is the correct syntax to allow all incoming traffic from pods in namespace frontend using a NetworkPolicy ingress rule?

easy

A. ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend

B. egress:
- to:
- namespaceSelector:
matchLabels:
name: frontend

C. ingress:
- to:
- namespaceSelector:
matchLabels:
name: frontend

D. egress:
- from:
- namespaceSelector:
matchLabels:
name: frontend

Solution

1. Step 1: Identify ingress rule syntax

   Ingress rules use ingress: with from: to specify allowed sources.

2. Step 2: Confirm namespaceSelector usage

   Using namespaceSelector with matchLabels is correct to select pods in a namespace.

3. Final Answer:

   ingress: - from: - namespaceSelector: matchLabels: name: frontend -> Option A

4. Quick Check:

   Ingress uses 'from' to allow incoming traffic [OK]

Hint: 'ingress' with 'from' allows incoming traffic sources [OK]

Common Mistakes:

• Using 'to' instead of 'from' in ingress
• Confusing ingress with egress syntax
• Misplacing namespaceSelector under egress

3. Given this NetworkPolicy snippet, what traffic is allowed?

egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
        except:
        - 10.0.0.5/32

medium

A. All outgoing traffic to 10.0.0.0/24 except 10.0.0.5

B. All incoming traffic from 10.0.0.0/24 except 10.0.0.5

C. All outgoing traffic to 10.0.0.5 only

D. All incoming traffic from 10.0.0.5 only

Solution

1. Step 1: Analyze egress rule with ipBlock

   The rule allows outgoing traffic to IPs in 10.0.0.0/24 except 10.0.0.5.

2. Step 2: Confirm direction and exceptions

   Egress means outgoing traffic; 'except' excludes 10.0.0.5 from allowed IPs.

3. Final Answer:

   All outgoing traffic to 10.0.0.0/24 except 10.0.0.5 -> Option A

4. Quick Check:

   Egress with ipBlock except excludes IPs [OK]

Hint: Egress 'to' with ipBlock allows excepted IPs blocked [OK]

Common Mistakes:

• Confusing ingress with egress direction
• Misreading 'except' as allowed IP
• Mixing incoming and outgoing traffic

4. You wrote this NetworkPolicy egress rule but pods still cannot reach external IPs:

egress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

What is the error?

medium

A. NetworkPolicy must not have egress rules

B. CIDR 0.0.0.0/0 is invalid

C. Missing 'ports' section

D. Egress rules use 'to', not 'from'

Solution

1. Step 1: Check egress rule syntax

   Egress rules specify destinations with 'to', not 'from'. Using 'from' is invalid here.

2. Step 2: Understand correct usage

   Correct egress syntax uses 'to' to define allowed outgoing IP blocks.

3. Final Answer:

   Egress rules use 'to', not 'from' -> Option D

4. Quick Check:

   Egress uses 'to' for destinations [OK]

Hint: Egress rules always use 'to' keyword [OK]

Common Mistakes:

• Using 'from' in egress rules
• Assuming CIDR 0.0.0.0/0 is invalid
• Thinking ports are always required

5. You want to restrict pods to only receive traffic from pods in the same namespace and send traffic only to a specific external IP range 192.168.1.0/24. Which NetworkPolicy configuration achieves this?

hard

A. ingress:
- from:
- podSelector: {}
egress:
- from:
- ipBlock:
cidr: 192.168.1.0/24

B. ingress:
- from:
- namespaceSelector: {}
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24

C. ingress:
- from:
- podSelector: {}
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24

D. ingress:
- to:
- podSelector: {}
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24

Solution

1. Step 1: Configure ingress to allow same-namespace pods

   Using podSelector: {} allows traffic from all pods in the same namespace.

2. Step 2: Configure egress to allow only specific external IP range

   Egress uses to with ipBlock for 192.168.1.0/24 to restrict outgoing traffic.

3. Final Answer:

   ingress: - from: - podSelector: {} egress: - to: - ipBlock: cidr: 192.168.1.0/24 -> Option C

4. Quick Check:

   Ingress 'from' podSelector + Egress 'to' ipBlock [OK]

Hint: Ingress uses 'from' podSelector; egress uses 'to' ipBlock [OK]

Common Mistakes:

• Using 'from' in egress rules
• Using namespaceSelector instead of podSelector for ingress
• Mixing 'to' and 'from' keywords incorrectly