Lesson 0029 · 25 minutes · Cluster Setup

Prevent a compromised frontend from reaching node metadata

Cloud instance-metadata endpoints commonly use a link-local address. A compromised Pod can attempt to reach them unless its egress is tightly allowlisted. An egress default-deny policy with narrow allowances is a dependable defence.

Timed task: 15 minutes

Read lab/lesson-29-fixture.yaml. Create lab/lesson-29-answer.yaml with one NetworkPolicy in namespace storefront.

It must select only Pods labelled app=frontend and permit egress only to:

Pods labelled app=payments-api in namespace payments-mesh, TCP port 8080;
CoreDNS Pods in kube-system, UDP and TCP port 53.

All other frontend egress must be denied, including node metadata and the public internet. Do not use an IP block, a wildcard namespace selector, or a second NetworkPolicy.

Reasoning hint: once a Pod is selected by an egress policy, traffic is denied unless an egress rule allows it. The payment destination requires both a Namespace selector and a Pod selector. DNS must be separately allowed because Service-name resolution needs it.

Verification

kubectl apply --dry-run=client -f .\lab\lesson-29-answer.yaml

What to send me

Save the policy, then say check. I will review one issue at a time.