Lesson 0008 · 35 minutes · Minimize Microservice Vulnerabilities

Build a default-deny network boundary from scratch

This is intentionally closer to an exam task: the workload fixture is supplied, but no NetworkPolicy skeleton or selector hints are provided.

Exam reflex: NetworkPolicies are additive. Start by naming which traffic must survive, then express the smallest set of ingress and egress exceptions after default denial.

Timed task: 25 minutes

Apply lab/lesson-8-fixture.yaml. Then create lab/lesson-8-answer.yaml containing the NetworkPolicies needed to meet every requirement below. Do not change the fixture.

In namespace cks-net-hard, default-deny both ingress and egress for every Pod.
Only the Pod labelled app=checkout may call the ledger Service on TCP port 8080.
checkout must be able to resolve Kubernetes Service names through cluster DNS.
ledger must not have any egress permission.
intruder must not be able to reach ledger.

Your answer must use label selectors. Do not use IP blocks, and do not allow all traffic to or from the namespace.

Verification

kubectl --context kind-cks-lab apply -f .\lab\lesson-8-fixture.yaml
kubectl --context kind-cks-lab -n cks-net-hard wait --for=condition=Ready pod/ledger pod/checkout pod/intruder --timeout=90s
kubectl --context kind-cks-lab apply -f .\lab\lesson-8-answer.yaml
kubectl --context kind-cks-lab -n cks-net-hard exec checkout -- wget -qO- -T 5 http://ledger:8080
kubectl --context kind-cks-lab -n cks-net-hard exec intruder -- wget -qO- -T 5 http://ledger:8080
kubectl --context kind-cks-lab -n cks-net-hard exec ledger -- wget -qO- -T 5 http://kubernetes.default

Expected results: checkout prints ledger; intruder times out; ledger times out. The two denied commands should have a non-zero exit code.

Retrieval check

Question

After a default-deny egress policy is applied to checkout, why can its request to http://ledger:8080 fail before a TCP connection is attempted?

The Pod also needs an egress allowance for DNS resolution.Services cannot work with NetworkPolicies.The ledger Pod needs unrestricted egress.

Documentation target

Use the official Network Policies reference. Inspect the CoreDNS labels in your own cluster before writing its selector.

What to send me

Paste only your policy YAML and the three command results. I’ll assess selector scope, DNS handling, and whether your default deny is genuinely complete.