Network policies for traffic control in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding default behavior of Kubernetes Network Policies

What is the default behavior of pod-to-pod traffic in a Kubernetes cluster when no NetworkPolicy is applied?

A All pod-to-pod traffic is allowed by default.

B All pod-to-pod traffic is denied by default.

C Traffic is allowed only within the same namespace.

D Traffic is allowed only if explicitly defined by a NetworkPolicy.

💡 Hint

Think about Kubernetes default networking model before any policies are applied.

By default, Kubernetes allows all pod-to-pod traffic without restrictions unless NetworkPolicies are applied to restrict it.

💻 Command Output

intermediate

Effect of a NetworkPolicy on ingress traffic

Given the following NetworkPolicy YAML applied to namespace dev, what will be the output of kubectl get pods and the connectivity result when a pod in dev tries to receive traffic from a pod in prod?

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: dev
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}

A Pods in dev namespace can receive traffic only from pods in dev namespace; traffic from prod namespace is blocked.

B Pods in dev namespace can receive traffic from any namespace; no traffic is blocked.

C Pods in dev namespace cannot receive any traffic, including from dev namespace pods.

D Pods in dev namespace can receive traffic only from pods in prod namespace; traffic from dev namespace is blocked.

💡 Hint

Look at the from field and the podSelector scope.

The NetworkPolicy allows ingress only from pods selected by an empty podSelector in the same namespace (dev). Pods from other namespaces like prod are blocked.

❓ Configuration

advanced

Creating a NetworkPolicy to allow egress only to a specific IP block

Which NetworkPolicy YAML correctly restricts egress traffic from all pods in the default namespace to only the IP block 10.0.0.0/24?

A

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.0.0.0/24

B

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24

C

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24

D

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.1.0/24

💡 Hint

Check the policyTypes and the IP block CIDR carefully.

Option C correctly sets policyTypes to Egress and restricts egress to the IP block 10.0.0.0/24. Other options either use wrong policyTypes or wrong CIDR.

❓ Troubleshoot

advanced

Diagnosing why a NetworkPolicy is not blocking traffic

You applied a NetworkPolicy to block all ingress traffic to pods in namespace test, but pods still receive traffic from other namespaces. What is the most likely reason?

A The NetworkPolicy uses an empty <code>podSelector</code>, which selects no pods.

B The NetworkPolicy is applied to the wrong namespace.

C The NetworkPolicy allows all ingress traffic explicitly in the <code>ingress</code> section.

D The NetworkPolicy does not specify <code>policyTypes: [Ingress]</code>, so it is not enforced.

💡 Hint

Check the namespace where the NetworkPolicy is applied versus where the pods are.

NetworkPolicies are namespace-scoped. If applied in a different namespace than the pods, they do not affect those pods.

🔀 Workflow

expert

Order of applying NetworkPolicies to restrict traffic

You want to restrict traffic so that pods in namespace frontend can only receive traffic from pods in namespace backend. Which sequence of steps correctly achieves this?

A 1. Apply a NetworkPolicy in <code>frontend</code> allowing ingress from <code>backend</code> pods only.<br>2. Remove any default allow policies.<br>3. Verify connectivity.

B 1. Apply a NetworkPolicy in <code>backend</code> allowing egress to <code>frontend</code> pods only.<br>2. Apply a NetworkPolicy in <code>frontend</code> allowing ingress from <code>backend</code> pods only.<br>3. Verify connectivity.

C 1. Apply a NetworkPolicy in <code>frontend</code> allowing ingress from <code>backend</code> pods only.<br>2. Apply a NetworkPolicy in <code>frontend</code> allowing ingress from all namespaces.<br>3. Verify connectivity.

D 1. Apply a NetworkPolicy in <code>frontend</code> allowing ingress from <code>backend</code> pods only.<br>2. Apply a NetworkPolicy in <code>backend</code> allowing egress to <code>frontend</code> pods only.<br>3. Verify connectivity.

💡 Hint

Think about both ingress and egress controls and where NetworkPolicies apply.

To restrict traffic properly, you must allow ingress in frontend from backend pods and also allow egress in backend to frontend pods. Both sides need policies to enforce restrictions.