Skip to content
CKADServices and NetworkingSingle nodeMedium

NetworkPolicy: default deny plus one allowed client

Scenario ckad-net-002 · about 8 minutes · 8 points · 8 grader checks

Lock down a namespace with a default-deny ingress policy and allow a single client label to reach an API on one port.

  • networkpolicy
  • default-deny
  • ingress
  • labels
  • networking

What you will practise

  • Write a default-deny ingress NetworkPolicy
  • Allow traffic from a podSelector on a specific port
  • Test connectivity from inside pods

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ckad-net-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Namespace "netpol" runs three Deployments: "api" (nginx, pod label app=api, exposed by the Service "api" on port 80), "frontend" (pod label role=frontend) and "other" (pod label role=other). Today every pod can reach "api". 1. Create a NetworkPolicy "default-deny-ingress" that denies all incoming traffic to every pod in "netpol". 2. Create a NetworkPolicy "api-allow-frontend" that allows only pods with the label role=frontend in the same namespace to reach the pods with label app=api, on TCP port 80 only. Afterwards the "frontend" pods must still get an HTTP answer from the Service "api", and the "other" pods must not.

Requirements and details

Certification
CKAD · Certified Kubernetes Application Developer
Domain
Services and Networking
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
8
Kubernetes version
1.37
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Services and Networking labs

CKADServices and NetworkingEasy

Expose a Deployment with ClusterIP and NodePort Services

Expose the same pods through a ClusterIP Service with port mapping and a NodePort Service on a fixed node port.

Single node · ~6 min · 9 points

  • service
  • clusterip
  • nodeport
  • endpoints

goldenkube start ckad-net-001

CKADServices and NetworkingMedium

Ingress with two paths and TLS

Expose two Services under one host with path-based Ingress rules and terminate TLS with a certificate Secret.

Single node · ~8 min · 9 points · Ingress

  • ingress
  • tls
  • secret
  • path-routing
  • networking

goldenkube start ckad-net-003

CKADServices and NetworkingEasy

Service with no working endpoints

Find why a Service does not reach the pods of a healthy Deployment and fix the Service.

Single node · ~6 min · 7 points

  • service
  • troubleshooting
  • selectors
  • endpoints

goldenkube start ckad-net-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.