Skip to content
CKAServices & NetworkingTwo nodesMedium

NetworkPolicy: allow ingress from one app only

Scenario cka-net-003 · about 9 minutes · 7 points · 7 grader checks

Restrict ingress to database pods so only client pods may reach them on a single TCP port.

  • networkpolicy
  • ingress
  • cilium
  • networking
  • security

What you will practise

  • Author a NetworkPolicy with podSelector and policyTypes
  • Allow ingress from specific pods on a specific port
  • Understand default-deny semantics of a selected pod

Start this lab

With the CLI installed and signed in, this command provisions a two nodes cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cka-net-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In namespace "secure" there are two Deployments: "db" (label app=db) and "client" (label app=client). Create a NetworkPolicy named "db-allow-client" in namespace "secure" that: - selects the pods labelled app=db - restricts INGRESS to those pods (policyTypes must include Ingress, so all other ingress is denied) - allows ingress ONLY from pods labelled app=client (same namespace), on TCP port 6379

Requirements and details

Certification
CKA · Certified Kubernetes Administrator
Domain
Services & Networking
Difficulty
Medium
Cluster topology
Two nodes
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
7
Grader checks
7
Kubernetes version
1.37
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 7 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Services & Networking labs

CKAServices & NetworkingEasy

ClusterIP Service for a Deployment

Expose an existing Deployment inside the cluster with a ClusterIP Service that selects all its pods.

Two nodes · ~6 min · 5 points

  • service
  • clusterip
  • endpoints
  • networking

goldenkube start cka-net-001

CKAServices & NetworkingEasy

NodePort Service with a fixed port

Expose a Deployment outside the cluster with a NodePort Service on a specific node port.

Two nodes · ~6 min · 5 points

  • service
  • nodeport
  • networking

goldenkube start cka-net-002

CKAServices & NetworkingMedium

Ingress routing to a Service

Create an Ingress that routes a hostname and path prefix to an existing Service through the nginx IngressClass.

Two nodes · ~8 min · 7 points · Ingress

  • ingress
  • ingressclass
  • nginx
  • networking

goldenkube start cka-net-004

CKAServices & NetworkingMedium

Gateway API HTTPRoute

Attach an HTTPRoute to an existing Gateway so a path prefix is routed to a Service.

Two nodes · ~9 min · 7 points · Gateway API

  • gateway-api
  • httproute
  • gateway
  • networking

goldenkube start cka-net-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.