2 lines
4.1 KiB
HTML
2 lines
4.1 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 8: NetworkPolicy default deny</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0008 · 35 minutes · Minimize Microservice Vulnerabilities</p><h1>Build a default-deny network boundary from scratch</h1><p class="lede">This is intentionally closer to an exam task: the workload fixture is supplied, but no NetworkPolicy skeleton or selector hints are provided.</p><div class="callout"><strong>Exam reflex:</strong> NetworkPolicies are additive. Start by naming which traffic must survive, then express the smallest set of ingress and egress exceptions after default denial.</div><h2>Timed task: 25 minutes</h2><p>Apply <code>lab/lesson-8-fixture.yaml</code>. Then create <code>lab/lesson-8-answer.yaml</code> containing the NetworkPolicies needed to meet every requirement below. Do not change the fixture.</p><ul><li>In namespace <code>cks-net-hard</code>, default-deny both ingress and egress for every Pod.</li><li>Only the Pod labelled <code>app=checkout</code> may call the <code>ledger</code> Service on TCP port <code>8080</code>.</li><li><code>checkout</code> must be able to resolve Kubernetes Service names through cluster DNS.</li><li><code>ledger</code> must not have any egress permission.</li><li><code>intruder</code> must not be able to reach <code>ledger</code>.</li></ul><p>Your answer must use label selectors. Do not use IP blocks, and do not allow all traffic to or from the namespace.</p><h2>Verification</h2><pre><code>kubectl --context kind-cks-lab apply -f .\lab\lesson-8-fixture.yaml kubectl --context kind-cks-lab -n cks-net-hard wait --for=condition=Ready pod/ledger pod/checkout pod/intruder --timeout=90s kubectl --context kind-cks-lab apply -f .\lab\lesson-8-answer.yaml kubectl --context kind-cks-lab -n cks-net-hard exec checkout -- wget -qO- -T 5 http://ledger:8080 kubectl --context kind-cks-lab -n cks-net-hard exec intruder -- wget -qO- -T 5 http://ledger:8080 kubectl --context kind-cks-lab -n cks-net-hard exec ledger -- wget -qO- -T 5 http://kubernetes.default</code></pre><p>Expected results: <code>checkout</code> prints <code>ledger</code>; <code>intruder</code> times out; <code>ledger</code> times out. The two denied commands should have a non-zero exit code.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>After a default-deny egress policy is applied to <code>checkout</code>, why can its request to <code>http://ledger:8080</code> fail before a TCP connection is attempted?</p><label><input type="radio" name="q" value="dns">The Pod also needs an egress allowance for DNS resolution.</label><label><input type="radio" name="q" value="service">Services cannot work with NetworkPolicies.</label><label><input type="radio" name="q" value="ingress">The ledger Pod needs unrestricted egress.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/">Network Policies</a> reference. Inspect the CoreDNS labels in your own cluster before writing its selector.</p><h2>What to send me</h2><p>Paste only your policy YAML and the three command results. I’ll assess selector scope, DNS handling, and whether your default deny is genuinely complete.</p><footer>Previous: <a href="0007-serviceaccount-token-exposure.html">ServiceAccount token exposure</a> · CKS domain: Minimize Microservice Vulnerabilities</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='dns'){f.textContent='Correct. Service names require DNS first, so default-deny egress needs a specific DNS exception.';f.className='feedback good';}else{f.textContent='Not quite. The service name must first be resolved through DNS, which egress policy can block.';f.className='feedback bad';}}</script></body></html>
|