Lesson 0034 · 35 minutes · Hard mode · Multi-domain

Harden and isolate a production API

This original performance task is deliberately denser than a focused drill. Secure the workload and its traffic boundary without changing its application contract.

Task

Apply lab/lesson-34-fixture.yaml. Create lab/lesson-34-answer.yaml containing exactly two resources: the corrected orders-api Deployment and one NetworkPolicy named orders-api-boundary.

Preserve the Deployment's name, namespace, replicas, selector, labels, ServiceAccount name, container names, images, commands, and port.

Workload requirements

Disable automatic ServiceAccount-token mounting.
Run the whole Pod as non-root UID and GID 10001, and set Pod-level fsGroup: 10001 so the non-root processes can write to their mounted volumes.
Apply RuntimeDefault seccomp to the whole Pod.
For both containers, disable privilege escalation, drop all capabilities, and make the root filesystem read-only.
Create a shared emptyDir mounted at /var/log/orders in both containers.
Create a separate emptyDir mounted at /srv only in api, allowing its preserved startup command to create the served file.

Network requirements

The single NetworkPolicy must select only app=orders-api, isolate both ingress and egress, and allow only:

ingress from Pods labelled app=edge-gateway in namespace edge, TCP port 8080;
egress to Pods labelled app=orders-db in namespace data, TCP port 5432; and
egress to Pods labelled k8s-app=kube-dns in namespace kube-system, UDP and TCP port 53.

Use the immutable namespace label kubernetes.io/metadata.name. Do not use ipBlock, empty peer selectors, additional policies, or wildcard ports.

Hard-mode traps: a Namespace selector and Pod selector must be in the same peer item to mean AND. Separate list items mean OR. NetworkPolicies are additive, DNS needs both protocols, and a read-only root filesystem needs every required writable path mounted explicitly.

Verification

kubectl apply --dry-run=client -f .\lab\lesson-34-answer.yaml
kubectl apply -f .\lab\lesson-34-answer.yaml
kubectl -n orders-prod rollout status deployment/orders-api --timeout=90s
kubectl -n orders-prod get deployment orders-api -o jsonpath='{.spec.template.spec.automountServiceAccountToken}{"\n"}'
kubectl -n orders-prod exec deploy/orders-api -c api -- sh -c 'test -f /srv/index.html && touch /var/log/orders/api.log'
kubectl -n orders-prod exec deploy/orders-api -c audit-writer -- test -f /var/log/orders/audit.log

Retrieval check

Question

How do you require both a namespace label and a Pod label for one NetworkPolicy peer?

Place both selectors inside the same peer list item. Place each selector inside a separate peer list item. Place each selector inside a separate NetworkPolicy object.

Documentation targets

After your first attempt, use the official Kubernetes Security Context and NetworkPolicy documentation.

What to send me

Save the two-resource answer and record your elapsed time. Then say check. I will list all issues and correct one per round. Ask a follow-up question whenever a requirement is ambiguous.