Network policies for security in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the kind of Kubernetes resource for a network policy.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: [1]
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx

Drag options to blanks, or click blank then click option'

AService

BIngress

CDeployment

DNetworkPolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Service' or 'Deployment' instead of 'NetworkPolicy' for the kind field.

The kind field must be NetworkPolicy to define a network policy resource in Kubernetes.

2fill in blank

medium

Complete the code to allow ingress traffic only from pods with label 'role: frontend'.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          [1]: frontend

Drag options to blanks, or click blank then click option'

Aapp

Brole

Ctier

Denv

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'app' or 'env' instead of 'role' as the label key.

The podSelector matches pods with label role: frontend to allow ingress from those pods.

3fill in blank

hard

Fix the error in the port specification to allow TCP traffic on port 80.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - ports:
    - protocol: TCP
      port: [1]

Drag options to blanks, or click blank then click option'

A80

B"eighty"

Chttp

Dtcp

Attempts:

3 left

💡 Hint

Common Mistakes

Using strings like 'eighty' or protocol names instead of numeric port.

The port must be a number like 80, not a string or protocol name.

4fill in blank

hard

Fill both blanks to create a network policy that denies all ingress traffic to pods labeled 'app: db'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector:
    matchLabels:
      app: [1]
  policyTypes:
  - [2]

Drag options to blanks, or click blank then click option'

Adb

BEgress

CIngress

Dfrontend

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Egress' instead of 'Ingress' in policyTypes.

Using wrong pod label.

The policy selects pods with label app: db and sets policyTypes to Ingress to deny all incoming traffic.

5fill in blank

hard

Fill all three blanks to allow ingress traffic on TCP port 443 from namespace 'frontend-ns' to pods labeled 'app: secure'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-https-frontend
spec:
  podSelector:
    matchLabels:
      app: [1]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: [2]
    ports:
    - protocol: TCP
      port: [3]

Drag options to blanks, or click blank then click option'

Asecure

Bfrontend-ns

C443

Dbackend

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong pod label or namespace label.

Using incorrect port number or protocol.

The policy selects pods with label app: secure, allows ingress from namespace labeled name: frontend-ns, and permits TCP traffic on port 443.

Practice

1. What is the main purpose of a Kubernetes NetworkPolicy?

easy

A. To update container images automatically

B. To schedule pods on specific nodes

C. To manage storage volumes for pods

D. To control which pods can communicate with each other

Solution

1. Step 1: Understand NetworkPolicy role

   A NetworkPolicy defines rules about pod communication inside a Kubernetes cluster.

2. Step 2: Identify main function

   It controls which pods can send or receive network traffic to improve security.

3. Final Answer:

   To control which pods can communicate with each other -> Option D

4. Quick Check:

   NetworkPolicy controls pod communication = A [OK]

Hint: NetworkPolicy controls pod communication, not scheduling or storage [OK]

Common Mistakes:

• Confusing NetworkPolicy with pod scheduling
• Thinking NetworkPolicy manages storage
• Assuming NetworkPolicy updates images

2. Which of the following is the correct way to specify a pod selector in a NetworkPolicy YAML?

easy

A. podSelector: labels: role: frontend

B. podSelector:
matchLabels:
role: frontend

C. podSelector: role=frontend

D. podSelector: role: frontend

Solution

1. Step 1: Recall podSelector syntax

   In NetworkPolicy YAML, podSelector uses matchLabels to select pods by labels.

2. Step 2: Match correct YAML format

   podSelector: matchLabels: role: frontend correctly uses podSelector with matchLabels syntax.

3. Final Answer:

   podSelector: matchLabels: role: frontend -> Option B

4. Quick Check:

   Correct podSelector uses matchLabels = C [OK]

Hint: Use matchLabels map inside podSelector for correct syntax [OK]

Common Mistakes:

• Using incorrect YAML indentation
• Omitting matchLabels key
• Writing labels without proper mapping

3. Given this NetworkPolicy snippet, what traffic is allowed?

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 80

medium

A. Only pods with label role=frontend can access nginx pods on TCP port 80

B. All pods can access nginx pods on any port

C. Only pods with label app=nginx can access frontend pods on port 80

D. No traffic is allowed to nginx pods

Solution

1. Step 1: Analyze podSelector and ingress rules

   The policy selects pods with label app: nginx and allows ingress only from pods with role: frontend on TCP port 80.

2. Step 2: Interpret allowed traffic

   Only pods labeled role=frontend can connect to nginx pods on TCP port 80; other traffic is blocked.

3. Final Answer:

   Only pods with label role=frontend can access nginx pods on TCP port 80 -> Option A

4. Quick Check:

   Ingress from role=frontend on port 80 = B [OK]

Hint: Ingress from podSelector limits source pods and ports [OK]

Common Mistakes:

• Assuming all pods can access nginx
• Confusing source and destination labels
• Ignoring port restrictions

4. You wrote this NetworkPolicy but pods labeled role=frontend still cannot access app=nginx pods on port 80. What is wrong?

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 8080

medium

A. The metadata name is incorrect

B. The podSelector is missing in the policy

C. The port in the policy is 8080 but nginx listens on port 80

D. The protocol TCP is not supported in NetworkPolicy

Solution

1. Step 1: Compare port in policy with actual service port

   The policy allows ingress on TCP port 8080, but nginx usually listens on port 80.

2. Step 2: Identify mismatch causing blocked traffic

   Because the port does not match nginx's listening port, traffic is blocked despite correct podSelector.

3. Final Answer:

   The port in the policy is 8080 but nginx listens on port 80 -> Option C

4. Quick Check:

   Port mismatch blocks traffic = D [OK]

Hint: Check port numbers match service and policy exactly [OK]

Common Mistakes:

• Ignoring port mismatch
• Assuming protocol TCP is unsupported
• Thinking metadata name affects traffic

5. You want to create a NetworkPolicy that allows pods labeled role=frontend to access pods labeled app=nginx on port 80, but blocks all other traffic. Which YAML snippet correctly achieves this?

hard

A. spec:
podSelector:
matchLabels:
app: nginx
ingress:
- from:
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 80

B. spec:
podSelector:
matchLabels:
role: frontend
ingress:
- from:
- podSelector:
matchLabels:
app: nginx
ports:
- protocol: TCP
port: 80

C. spec:
podSelector:
matchLabels:
app: nginx
egress:
- to:
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 80

D. spec:
podSelector:
matchLabels:
app: nginx
ingress:
- from:
- namespaceSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 80

Solution

1. Step 1: Identify pods to protect and allowed sources

   The policy must select pods with app: nginx and allow ingress only from pods with role: frontend.

2. Step 2: Check ingress rules and ports

   spec: podSelector: matchLabels: app: nginx ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 80 correctly uses podSelector for nginx pods and allows ingress from frontend pods on TCP port 80.

3. Step 3: Confirm other options are incorrect

   The snippet that selects role: frontend in podSelector but has from app: nginx reverses source and destination; the snippet using egress and to controls outgoing traffic; the snippet using namespaceSelector selects entire namespaces instead of specific pods.

4. Final Answer:

   spec: podSelector: matchLabels: app: nginx ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 80 -> Option A

5. Quick Check:

   Correct podSelector and ingress from frontend pods = A [OK]

Hint: Select nginx pods and allow ingress from frontend pods on port 80 [OK]

Common Mistakes:

• Mixing up podSelector labels
• Using egress instead of ingress
• Using namespaceSelector instead of podSelector