Network policies for traffic control in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the kind of Kubernetes resource for network policies.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: [1]
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx

Drag options to blanks, or click blank then click option'

AService

BNetworkPolicy

CConfigMap

DDeployment

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Service' or 'Deployment' instead of 'NetworkPolicy'.

Leaving the kind field empty.

The kind field must be NetworkPolicy to define network policies in Kubernetes.

2fill in blank

medium

Complete the code to allow ingress traffic only from pods with label 'role: frontend'.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          [1]: frontend

Drag options to blanks, or click blank then click option'

Arole

Bapp

Cenv

Dtier

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'app' instead of 'role' as the label key.

Using unrelated label keys like 'env' or 'tier'.

The role label is used to select pods with role 'frontend' for ingress traffic.

3fill in blank

hard

Fix the error in the policy to allow TCP traffic on port 80 only.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - ports:
    - protocol: TCP
      port: [1]

Drag options to blanks, or click blank then click option'

A80

Bhttp

C443

Dtcp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' or 'tcp' as port value instead of a number.

Using port 443 which is for HTTPS.

The port must be specified as the number 80 to allow HTTP traffic on TCP port 80.

4fill in blank

hard

Fill both blanks to create a policy that denies all egress traffic from pods labeled 'app: db'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db-egress
spec:
  podSelector:
    matchLabels:
      app: [1]
  policyTypes:
  - [2]

Drag options to blanks, or click blank then click option'

Adb

BIngress

CEgress

DAll

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Ingress' instead of 'Egress' for policyTypes.

Using wrong label value instead of 'db'.

The podSelector must select pods with label app: db and the policy type must be Egress to deny outgoing traffic.

5fill in blank

hard

Fill all three blanks to create a network policy that allows ingress TCP traffic on port 443 from pods with label 'role: frontend' to pods labeled 'app: secure'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-secure-ingress
spec:
  podSelector:
    matchLabels:
      app: [1]
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: [2]
    ports:
    - protocol: [3]
      port: 443

Drag options to blanks, or click blank then click option'

Asecure

Bfrontend

CTCP

DUDP

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'UDP' instead of 'TCP' for protocol.

Mixing up source and destination labels.

Using wrong port number.

The policy selects pods with app: secure, allows ingress from pods with role: frontend, and permits TCP traffic on port 443.

Practice

1. What is the primary purpose of a Kubernetes NetworkPolicy?

easy

A. To control traffic flow between pods and namespaces

B. To schedule pods on specific nodes

C. To manage storage volumes for pods

D. To monitor pod resource usage

Solution

1. Step 1: Understand NetworkPolicy role

   Kubernetes NetworkPolicy is designed to control how pods communicate with each other and with other network endpoints.

2. Step 2: Identify correct function

   It specifically allows or blocks traffic between pods and namespaces to improve security.

3. Final Answer:

   To control traffic flow between pods and namespaces -> Option A

4. Quick Check:

   NetworkPolicy controls pod traffic = A [OK]

Hint: NetworkPolicy controls pod communication, not scheduling or storage [OK]

Common Mistakes:

• Confusing NetworkPolicy with pod scheduling
• Thinking NetworkPolicy manages storage
• Assuming NetworkPolicy monitors resources

2. Which of the following is the correct syntax to specify a pod selector in a NetworkPolicy YAML?

easy

A. podSelector: matchLabels: app: frontend

B. podSelector: labels: app=frontend

C. podSelector: app: frontend

D. podSelector: matchLabels: {app: frontend}

Solution

1. Step 1: Recall podSelector syntax

   The correct syntax uses matchLabels under podSelector with key-value pairs properly indented.

2. Step 2: Compare options

   podSelector: matchLabels: app: frontend correctly uses podSelector: matchLabels: app: frontend. podSelector: matchLabels: {app: frontend} uses braces which is invalid YAML here.

3. Final Answer:

   podSelector: matchLabels: app: frontend -> Option A

4. Quick Check:

   Use matchLabels with key: value YAML format [OK]

Hint: Use matchLabels with key: value indentation for podSelector [OK]

Common Mistakes:

• Using incorrect YAML braces {} in podSelector
• Writing labels as key=value instead of key: value
• Omitting matchLabels keyword

3. Given this NetworkPolicy snippet, what traffic is allowed?

spec:
  podSelector:
    matchLabels:
      role: db
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 3306

medium

A. All pods can access db pods on any port

B. Only pods with label role=db can access frontend pods on port 3306

C. Only pods with label role=frontend can access db pods on TCP port 3306

D. No traffic is allowed to db pods

Solution

1. Step 1: Analyze podSelector and ingress rules

   The policy selects pods with label role: db. It allows ingress only from pods with role: frontend on TCP port 3306.

2. Step 2: Interpret traffic allowed

   Only pods labeled frontend can connect to db pods on port 3306. Other traffic is blocked.

3. Final Answer:

   Only pods with label role=frontend can access db pods on TCP port 3306 -> Option C

4. Quick Check:

   Ingress from frontend pods on port 3306 = C [OK]

Hint: Check podSelector and ingress from podSelector with ports [OK]

Common Mistakes:

• Assuming all pods can access db pods
• Confusing source and destination pod labels
• Ignoring port restrictions

4. You wrote this NetworkPolicy but traffic is still blocked:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels:
      role: db
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: frontend-ns
    ports:
    - protocol: TCP
      port: 3306

What is the likely error?

medium

A. Port 3306 must be specified as a string

B. Namespace label key should be 'kubernetes.io/metadata.name' not 'name'

C. Protocol TCP is not supported in NetworkPolicy

D. podSelector is missing in the ingress rule

Solution

1. Step 1: Check namespaceSelector label key

   Namespace labels usually use the key kubernetes.io/metadata.name for the namespace name, not just name.

2. Step 2: Understand impact on traffic

   Using incorrect label key means no namespaces match, so ingress is blocked.

3. Final Answer:

   Namespace label key should be 'kubernetes.io/metadata.name' not 'name' -> Option B

4. Quick Check:

   Correct namespace label key fixes traffic block = D [OK]

Hint: Use correct namespace label key: kubernetes.io/metadata.name [OK]

Common Mistakes:

• Using wrong label key for namespaceSelector
• Thinking protocol TCP is unsupported
• Misunderstanding port data type requirements

5. You want to allow all pods in namespace 'frontend' to access pods labeled 'role=db' only on port 5432 TCP, but block all other traffic. Which NetworkPolicy YAML snippet correctly achieves this?

hard

A. spec:
podSelector:
matchLabels:
role: db
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend
ports:
- protocol: UDP
port: 5432

B. spec:
podSelector:
matchLabels:
role: db
ingress:
- from:
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 5432

C. spec:
podSelector:
matchLabels:
role: frontend
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: db
ports:
- protocol: TCP
port: 5432

D. spec:
podSelector:
matchLabels:
role: db
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: frontend
ports:
- protocol: TCP
port: 5432

Solution

1. Step 1: Identify podSelector and allowed source

   The policy must select pods with role: db and allow ingress only from pods in namespace 'frontend'. This requires namespaceSelector with correct label key.

2. Step 2: Check port and protocol correctness

   Port must be 5432 TCP. spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: frontend ports: - protocol: TCP port: 5432 uses correct protocol TCP and correct namespace label key kubernetes.io/metadata.name.

3. Step 3: Verify other options

   spec: podSelector: matchLabels: role: db ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 5432 uses podSelector for frontend pods, not namespaceSelector, so it restricts source pods incorrectly. spec: podSelector: matchLabels: role: frontend ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: db ports: - protocol: TCP port: 5432 selects wrong pods and namespaces. spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: name: frontend ports: - protocol: UDP port: 5432 uses wrong protocol UDP and wrong namespace label key.

4. Final Answer:

   spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: frontend ports: - protocol: TCP port: 5432 -> Option D

5. Quick Check:

   Correct podSelector, namespaceSelector, TCP port 5432 = A [OK]

Hint: Use podSelector for db pods, namespaceSelector with correct label, TCP port 5432 [OK]

Common Mistakes:

• Using podSelector instead of namespaceSelector for source
• Wrong namespace label key
• Using UDP instead of TCP for port 5432