CKSKubernetes 1.35

Exercises

Exercise: deny everything, then open one port

updated 2026-10-22 by seed

Host: controlplane · Time: 6 min · Domain: Cluster Setup

Task

  • Namespace prod exists with frontend (label tier=frontend) and backend (label tier=backend, container port 3000) running.
  • Deny all ingress and egress in prod.
  • Allow only frontend → backend on TCP 3000.
  • Keep DNS working for every Pod in the namespace.

Acceptance criteria

  • A pod that is neither frontend nor backend cannot reach backend:3000.
  • frontend reaches backend:3000.
  • nslookup backend still resolves from inside backend.

Solution

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: default-deny, namespace: prod}
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: allow-dns, namespace: prod}
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector: {}
    ports:
    - {protocol: UDP, port: 53}
    - {protocol: TCP, port: 53}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: frontend-to-backend, namespace: prod}
spec:
  podSelector:
    matchLabels: {tier: backend}
  policyTypes: [Ingress]
  ingress:
  - from:
    - podSelector: {matchLabels: {tier: frontend}}
    ports:
    - {protocol: TCP, port: 3000}
kubectl exec -n prod deploy/frontend -- wget -qO- --timeout=2 http://backend:3000
kubectl exec -n prod deploy/other   -- wget -qO- --timeout=2 http://backend:3000  # fails

Why it works: policies are additive. Default-deny blocks everything; the DNS
policy re-opens 53; the last policy re-opens one path into backend.