Skip to content
ICASecuring WorkloadsSingle nodeMedium

Deny by default, allow reads, deny one caller

Scenario ica-sec-005 · about 9 minutes · 9 points · 5 grader checks

Combine a namespace-wide deny-all with an ALLOW and a DENY AuthorizationPolicy and reason about their evaluation order.

  • authorizationpolicy
  • deny-by-default
  • allow-nothing
  • deny
  • securing-workloads

What you will practise

  • Create an allow-nothing policy for a namespace
  • Allow specific methods and paths for callers of one namespace
  • Use a DENY policy that wins over ALLOW

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-sec-005

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed. Namespace "catalog" is in the mesh and runs the Service "catalog" (port 8000, pods labelled app=catalog) and the client Deployments "curl" (ServiceAccount "curl") and "auditor" (ServiceAccount "auditor"). Create three AuthorizationPolicies in "catalog": 1. "allow-nothing": deny every request to every workload in the namespace unless another policy allows it. 2. "catalog-read": for the pods app=catalog, allow method GET on the paths /get and /status/* for requests from workloads in namespace "catalog". 3. "catalog-no-auditor-status": for the pods app=catalog, deny requests from the ServiceAccount "auditor" of namespace "catalog" to the paths /status/*.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Securing Workloads
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
9
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Securing Workloads labs

ICASecuring WorkloadsEasy

Mesh-wide strict mTLS with a namespace exception

Require mutual TLS for the whole mesh while one legacy namespace keeps accepting plain text.

Single node · ~7 min · 7 points

  • mtls
  • peerauthentication
  • strict
  • permissive
  • securing-workloads

goldenkube start ica-sec-001

ICASecuring WorkloadsMedium

Allow one service account to call two paths

Write an ALLOW AuthorizationPolicy that admits a single workload identity for GET on two paths and nothing else.

Single node · ~8 min · 8 points

  • authorizationpolicy
  • allow
  • principals
  • spiffe
  • securing-workloads

goldenkube start ica-sec-002

ICASecuring WorkloadsHard

Require a valid JWT for a workload

Validate end-user JWTs with a RequestAuthentication and an inline key set, and deny requests that carry no token.

Single node · ~9 min · 9 points

  • jwt
  • requestauthentication
  • authorizationpolicy
  • request-principals
  • securing-workloads

goldenkube start ica-sec-003

ICASecuring WorkloadsHard

Terminate TLS at the ingress gateway with an HTTPS redirect

Serve a host over HTTPS at the ingress gateway from a Kubernetes TLS secret and redirect plain HTTP to HTTPS.

Single node · ~10 min · 10 points

  • gateway
  • tls
  • https-redirect
  • credentialname
  • securing-workloads

goldenkube start ica-sec-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.