Network policies for traffic control in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the kind of Kubernetes resource for network policies.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: [1]
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx

Drag options to blanks, or click blank then click option'

AService

BNetworkPolicy

CConfigMap

DDeployment

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Service' or 'Deployment' instead of 'NetworkPolicy'.

Leaving the kind field empty.

The kind field must be NetworkPolicy to define network policies in Kubernetes.

2fill in blank

medium

Complete the code to allow ingress traffic only from pods with label 'role: frontend'.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          [1]: frontend

Drag options to blanks, or click blank then click option'

Arole

Bapp

Cenv

Dtier

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'app' instead of 'role' as the label key.

Using unrelated label keys like 'env' or 'tier'.

The role label is used to select pods with role 'frontend' for ingress traffic.

3fill in blank

hard

Fix the error in the policy to allow TCP traffic on port 80 only.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - ports:
    - protocol: TCP
      port: [1]

Drag options to blanks, or click blank then click option'

A80

Bhttp

C443

Dtcp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' or 'tcp' as port value instead of a number.

Using port 443 which is for HTTPS.

The port must be specified as the number 80 to allow HTTP traffic on TCP port 80.

4fill in blank

hard

Fill both blanks to create a policy that denies all egress traffic from pods labeled 'app: db'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db-egress
spec:
  podSelector:
    matchLabels:
      app: [1]
  policyTypes:
  - [2]

Drag options to blanks, or click blank then click option'

Adb

BIngress

CEgress

DAll

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Ingress' instead of 'Egress' for policyTypes.

Using wrong label value instead of 'db'.

The podSelector must select pods with label app: db and the policy type must be Egress to deny outgoing traffic.

5fill in blank

hard

Fill all three blanks to create a network policy that allows ingress TCP traffic on port 443 from pods with label 'role: frontend' to pods labeled 'app: secure'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-secure-ingress
spec:
  podSelector:
    matchLabels:
      app: [1]
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: [2]
    ports:
    - protocol: [3]
      port: 443

Drag options to blanks, or click blank then click option'

Asecure

Bfrontend

CTCP

DUDP

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'UDP' instead of 'TCP' for protocol.

Mixing up source and destination labels.

Using wrong port number.

The policy selects pods with app: secure, allows ingress from pods with role: frontend, and permits TCP traffic on port 443.