Network policies for security in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the kind of Kubernetes resource for a network policy.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: [1]
metadata:
  name: allow-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx

Drag options to blanks, or click blank then click option'

AService

BIngress

CDeployment

DNetworkPolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Service' or 'Deployment' instead of 'NetworkPolicy' for the kind field.

The kind field must be NetworkPolicy to define a network policy resource in Kubernetes.

2fill in blank

medium

Complete the code to allow ingress traffic only from pods with label 'role: frontend'.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          [1]: frontend

Drag options to blanks, or click blank then click option'

Aapp

Brole

Ctier

Denv

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'app' or 'env' instead of 'role' as the label key.

The podSelector matches pods with label role: frontend to allow ingress from those pods.

3fill in blank

hard

Fix the error in the port specification to allow TCP traffic on port 80.

Kubernetes

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - ports:
    - protocol: TCP
      port: [1]

Drag options to blanks, or click blank then click option'

A80

B"eighty"

Chttp

Dtcp

Attempts:

3 left

💡 Hint

Common Mistakes

Using strings like 'eighty' or protocol names instead of numeric port.

The port must be a number like 80, not a string or protocol name.

4fill in blank

hard

Fill both blanks to create a network policy that denies all ingress traffic to pods labeled 'app: db'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector:
    matchLabels:
      app: [1]
  policyTypes:
  - [2]

Drag options to blanks, or click blank then click option'

Adb

BEgress

CIngress

Dfrontend

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Egress' instead of 'Ingress' in policyTypes.

Using wrong pod label.

The policy selects pods with label app: db and sets policyTypes to Ingress to deny all incoming traffic.

5fill in blank

hard

Fill all three blanks to allow ingress traffic on TCP port 443 from namespace 'frontend-ns' to pods labeled 'app: secure'.

Kubernetes

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-https-frontend
spec:
  podSelector:
    matchLabels:
      app: [1]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: [2]
    ports:
    - protocol: TCP
      port: [3]

Drag options to blanks, or click blank then click option'

Asecure

Bfrontend-ns

C443

Dbackend

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong pod label or namespace label.

Using incorrect port number or protocol.

The policy selects pods with label app: secure, allows ingress from namespace labeled name: frontend-ns, and permits TCP traffic on port 443.