2 lines
1.8 KiB
HTML
2 lines
1.8 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 29: Node metadata egress isolation</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0029 · 25 minutes · Cluster Setup</p><h1>Prevent a compromised frontend from reaching node metadata</h1><p class="lede">Cloud instance-metadata endpoints commonly use a link-local address. A compromised Pod can attempt to reach them unless its egress is tightly allowlisted. An egress default-deny policy with narrow allowances is a dependable defence.</p><h2>Timed task: 15 minutes</h2><p>Read <code>lab/lesson-29-fixture.yaml</code>. Create <code>lab/lesson-29-answer.yaml</code> with one <code>NetworkPolicy</code> in namespace <code>storefront</code>.</p><p>It must select only Pods labelled <code>app=frontend</code> and permit egress only to:</p><ul><li>Pods labelled <code>app=payments-api</code> in namespace <code>payments-mesh</code>, TCP port <code>8080</code>;</li><li>CoreDNS Pods in <code>kube-system</code>, UDP and TCP port <code>53</code>.</li></ul><p>All other frontend egress must be denied, including node metadata and the public internet. Do not use an IP block, a wildcard namespace selector, or a second NetworkPolicy.</p><div class="callout"><strong>Reasoning hint:</strong> once a Pod is selected by an egress policy, traffic is denied unless an egress rule allows it. The payment destination requires both a Namespace selector and a Pod selector. DNS must be separately allowed because Service-name resolution needs it.</div><h2>Verification</h2><pre><code>kubectl apply --dry-run=client -f .\lab\lesson-29-answer.yaml</code></pre><h2>What to send me</h2><p>Save the policy, then say <em>check</em>. I will review one issue at a time.</p></main></body></html>
|