Certified Kubernetes Administrator CKA — Question 19

Topic 1 · Question 19 of 23

Topic 1 · Question 19

SIMULATION - Task - Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace internal to connect to port 9200/tcp of Pods in namespace echo. Further ensure that the new NetworkPolicy: • does not allow access to Pods, which don't listen on port 9200/tcp • does not allow access from Pods, which are not in namespace internal

Suggested solution

cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: allow-port-from-namespace, namespace: echo}
spec:
  podSelector: {}
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels: {kubernetes.io/metadata.name: internal}
    ports:
    - {protocol: TCP, port: 9200}
EOF

The policy permits only TCP 9200 ingress from the internal namespace to Pods in echo.

View community discussion →