BEFORE APPLYING POLICY
====================
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k get svc,deploy,pods -o wide --show-labels -n frontend
NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR LABELS
deployment.apps/frontend-deployment 1/1 1 1 17m frontend curlimages/curl app=frontend <none>
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS
pod/frontend-deployment-5cfd995957-dqjxb 1/1 Running 0 17m 192.168.1.217 node01 <none> <none> app=frontend,pod-template-hash=5cfd995957
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k get svc,deploy,pods -o wide --show-labels -n backend
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR LABELS
service/backend-service ClusterIP 10.102.61.7 <none> 80/TCP 17m app=backend <none>
NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR LABELS
deployment.apps/backend-deployment 1/1 1 1 17m backend nginx app=backend <none>
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS
pod/backend-deployment-75845df6f4-gg4dm 1/1 Running 0 17m 192.168.1.196 node01 <none> <none> app=backend,pod-template-hash=75845df6f4
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k exec pod/frontend-deployment-5cfd995957-dqjxb -n frontend -it -- curl http://10.102.61.7
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, nginx is successfully installed and working.
Further configuration is required for the web server, reverse proxy,
API gateway, load balancer, content cache, or other features.</p>
<p>For online documentation and support please refer to
<a href="https://nginx.org/">nginx.org</a>.<br/>
To engage with the community please visit
<a href="https://community.nginx.org/">community.nginx.org</a>.<br/>
For enterprise grade support, professional services, additional
security features and capabilities please refer to
<a href="https://f5.com/nginx">f5.com/nginx</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
AFTER APPLYING POLICY
====================
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k apply -f /root/network-policies/network-policy-3.yaml
networkpolicy.networking.k8s.io/policy-z created
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k exec pod/frontend-deployment-5cfd995957-dqjxb -n frontend -it -- curl http://10.102.61.7
curl: (28) Failed to connect to 10.102.61.7 port 80 after 136151 ms: Could not connect to server
command terminated with exit code 28
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ cat /root/network-policies/network-policy-3.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: policy-z
namespace: backend
spec:
podSelector:
matchLabels:
app: backend
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: frontend
podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 80
policyTypes:
- Ingress
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k replace -f /root/network-policies/network-policy-3.yaml --force
networkpolicy.networking.k8s.io "policy-z" deleted from backend namespace
networkpolicy.networking.k8s.io/policy-z replaced
root@controlplane:~/CKA-PREP-2025-v2/Question-13 Network-Policy$ k exec pod/frontend-deployment-5cfd995957-dqjxb -n frontend -it -- curl http://10.102.61.7
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, nginx is successfully installed and working.
Further configuration is required for the web server, reverse proxy,
API gateway, load balancer, content cache, or other features.</p>
<p>For online documentation and support please refer to
<a href="https://nginx.org/">nginx.org</a>.<br/>
To engage with the community please visit
<a href="https://community.nginx.org/">community.nginx.org</a>.<br/>
For enterprise grade support, professional services, additional
security features and capabilities please refer to
<a href="https://f5.com/nginx">f5.com/nginx</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
Using less permissive policy does not work:
/root/network-policies/network-policy-3.yamlCorrect policy is: