Network policies for traffic control in Kubernetes - Mini Project: Build & Apply

Network policies for traffic control

📖 Scenario: You are managing a Kubernetes cluster for a small online store. You want to control which pods can communicate with each other to improve security.

🎯 Goal: Create a Kubernetes NetworkPolicy that allows only pods with the label role=frontend to receive traffic on port 80 from pods with the label role=backend.

📋 What You'll Learn

Create a NetworkPolicy YAML manifest named allow-backend-to-frontend.yaml.

The policy should select pods with label role=frontend.

Allow ingress traffic only on port 80 from pods with label role=backend.

Deny all other ingress traffic to the selected pods.

💡 Why This Matters

🌍 Real World

NetworkPolicies help secure Kubernetes clusters by controlling which pods can talk to each other, reducing attack surfaces.

💼 Career

Understanding NetworkPolicies is essential for Kubernetes administrators and DevOps engineers to enforce security and compliance in cloud-native environments.

1

Create the basic NetworkPolicy skeleton

Create a YAML manifest named allow-backend-to-frontend.yaml with the following keys: apiVersion set to networking.k8s.io/v1, kind set to NetworkPolicy, and metadata with name set to allow-backend-to-frontend. Also add an empty spec section.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-frontend
spec:
# Your code here

Hint

Start by defining the basic structure of a NetworkPolicy YAML file with the required keys.

2

Add pod selector for frontend pods

In the spec section, add podSelector with matchLabels selecting pods with role: frontend. This will target the frontend pods for the policy.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-frontend
spec:
  # Add podSelector with matchLabels role: frontend here
  # Your code here

Hint

Use podSelector with matchLabels to select pods labeled role: frontend.

3

Add ingress rule to allow traffic from backend pods on port 80

Under spec, add an ingress rule that allows traffic on port 80 from pods with label role: backend. Use from with podSelector matching role: backend and specify ports with port: 80 and protocol: TCP.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-frontend
spec:
  podSelector:
    matchLabels:
      role: frontend
  # Add ingress rule to allow traffic from backend pods on port 80
  # Your code here

Hint

Use ingress with from and ports to allow traffic from backend pods on TCP port 80.

4

Apply the NetworkPolicy and verify

Run kubectl apply -f allow-backend-to-frontend.yaml to apply the NetworkPolicy. Then run kubectl get networkpolicy allow-backend-to-frontend -o yaml to display the applied policy.

Kubernetes

# Run the commands below in your terminal
# Your code here

Hint

Use kubectl apply to create the policy and kubectl get to verify it.

Practice

1. What is the primary purpose of a Kubernetes NetworkPolicy?

easy

A. To control traffic flow between pods and namespaces

B. To schedule pods on specific nodes

C. To manage storage volumes for pods

D. To monitor pod resource usage

Solution

1. Step 1: Understand NetworkPolicy role

   Kubernetes NetworkPolicy is designed to control how pods communicate with each other and with other network endpoints.

2. Step 2: Identify correct function

   It specifically allows or blocks traffic between pods and namespaces to improve security.

3. Final Answer:

   To control traffic flow between pods and namespaces -> Option A

4. Quick Check:

   NetworkPolicy controls pod traffic = A [OK]

Hint: NetworkPolicy controls pod communication, not scheduling or storage [OK]

Common Mistakes:

• Confusing NetworkPolicy with pod scheduling
• Thinking NetworkPolicy manages storage
• Assuming NetworkPolicy monitors resources

2. Which of the following is the correct syntax to specify a pod selector in a NetworkPolicy YAML?

easy

A. podSelector: matchLabels: app: frontend

B. podSelector: labels: app=frontend

C. podSelector: app: frontend

D. podSelector: matchLabels: {app: frontend}

Solution

1. Step 1: Recall podSelector syntax

   The correct syntax uses matchLabels under podSelector with key-value pairs properly indented.

2. Step 2: Compare options

   podSelector: matchLabels: app: frontend correctly uses podSelector: matchLabels: app: frontend. podSelector: matchLabels: {app: frontend} uses braces which is invalid YAML here.

3. Final Answer:

   podSelector: matchLabels: app: frontend -> Option A

4. Quick Check:

   Use matchLabels with key: value YAML format [OK]

Hint: Use matchLabels with key: value indentation for podSelector [OK]

Common Mistakes:

• Using incorrect YAML braces {} in podSelector
• Writing labels as key=value instead of key: value
• Omitting matchLabels keyword

3. Given this NetworkPolicy snippet, what traffic is allowed?

spec:
  podSelector:
    matchLabels:
      role: db
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 3306

medium

A. All pods can access db pods on any port

B. Only pods with label role=db can access frontend pods on port 3306

C. Only pods with label role=frontend can access db pods on TCP port 3306

D. No traffic is allowed to db pods

Solution

1. Step 1: Analyze podSelector and ingress rules

   The policy selects pods with label role: db. It allows ingress only from pods with role: frontend on TCP port 3306.

2. Step 2: Interpret traffic allowed

   Only pods labeled frontend can connect to db pods on port 3306. Other traffic is blocked.

3. Final Answer:

   Only pods with label role=frontend can access db pods on TCP port 3306 -> Option C

4. Quick Check:

   Ingress from frontend pods on port 3306 = C [OK]

Hint: Check podSelector and ingress from podSelector with ports [OK]

Common Mistakes:

• Assuming all pods can access db pods
• Confusing source and destination pod labels
• Ignoring port restrictions

4. You wrote this NetworkPolicy but traffic is still blocked:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels:
      role: db
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: frontend-ns
    ports:
    - protocol: TCP
      port: 3306

What is the likely error?

medium

A. Port 3306 must be specified as a string

B. Namespace label key should be 'kubernetes.io/metadata.name' not 'name'

C. Protocol TCP is not supported in NetworkPolicy

D. podSelector is missing in the ingress rule

Solution

1. Step 1: Check namespaceSelector label key

   Namespace labels usually use the key kubernetes.io/metadata.name for the namespace name, not just name.

2. Step 2: Understand impact on traffic

   Using incorrect label key means no namespaces match, so ingress is blocked.

3. Final Answer:

   Namespace label key should be 'kubernetes.io/metadata.name' not 'name' -> Option B

4. Quick Check:

   Correct namespace label key fixes traffic block = D [OK]

Hint: Use correct namespace label key: kubernetes.io/metadata.name [OK]

Common Mistakes:

• Using wrong label key for namespaceSelector
• Thinking protocol TCP is unsupported
• Misunderstanding port data type requirements

5. You want to allow all pods in namespace 'frontend' to access pods labeled 'role=db' only on port 5432 TCP, but block all other traffic. Which NetworkPolicy YAML snippet correctly achieves this?

hard

A. spec:
podSelector:
matchLabels:
role: db
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend
ports:
- protocol: UDP
port: 5432

B. spec:
podSelector:
matchLabels:
role: db
ingress:
- from:
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 5432

C. spec:
podSelector:
matchLabels:
role: frontend
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: db
ports:
- protocol: TCP
port: 5432

D. spec:
podSelector:
matchLabels:
role: db
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: frontend
ports:
- protocol: TCP
port: 5432

Solution

1. Step 1: Identify podSelector and allowed source

   The policy must select pods with role: db and allow ingress only from pods in namespace 'frontend'. This requires namespaceSelector with correct label key.

2. Step 2: Check port and protocol correctness

   Port must be 5432 TCP. spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: frontend ports: - protocol: TCP port: 5432 uses correct protocol TCP and correct namespace label key kubernetes.io/metadata.name.

3. Step 3: Verify other options

   spec: podSelector: matchLabels: role: db ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 5432 uses podSelector for frontend pods, not namespaceSelector, so it restricts source pods incorrectly. spec: podSelector: matchLabels: role: frontend ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: db ports: - protocol: TCP port: 5432 selects wrong pods and namespaces. spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: name: frontend ports: - protocol: UDP port: 5432 uses wrong protocol UDP and wrong namespace label key.

4. Final Answer:

   spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: frontend ports: - protocol: TCP port: 5432 -> Option D

5. Quick Check:

   Correct podSelector, namespaceSelector, TCP port 5432 = A [OK]

Hint: Use podSelector for db pods, namespaceSelector with correct label, TCP port 5432 [OK]

Common Mistakes:

• Using podSelector instead of namespaceSelector for source
• Wrong namespace label key
• Using UDP instead of TCP for port 5432