38 lines
1.1 KiB
Markdown
38 lines
1.1 KiB
Markdown
# Isolated CKS NetworkPolicy lab
|
|
|
|
This lab runs in the local Kind context `kind-cks-lab`, separate from the pre-existing `monitoring-context` cluster.
|
|
|
|
## Scenario
|
|
|
|
`api` and `intruder` are clients. `db` serves HTTP on port 8080. The policy allows only pods labelled `app=api` to reach the database.
|
|
|
|
## Repeat the proof
|
|
|
|
```powershell
|
|
kubectl --context kind-cks-lab -n cks-lab exec api -- wget -qO- -T 5 http://db:8080
|
|
kubectl --context kind-cks-lab -n cks-lab exec intruder -- wget -qO- -T 5 http://db:8080
|
|
```
|
|
|
|
The first command must print `database`. The second must time out, which proves the denial.
|
|
|
|
## Inspect the answer
|
|
|
|
```powershell
|
|
kubectl --context kind-cks-lab -n cks-lab get networkpolicy db-only-from-api -o yaml
|
|
kubectl --context kind-cks-lab -n cks-lab get pods --show-labels
|
|
```
|
|
|
|
The policy is in `networkpolicy-lab.yaml`. Edit it for new drills, then run:
|
|
|
|
```powershell
|
|
kubectl --context kind-cks-lab apply -f .\lab\networkpolicy-lab.yaml
|
|
```
|
|
|
|
## Cleanup
|
|
|
|
This is destructive and removes only the isolated Kind cluster:
|
|
|
|
```powershell
|
|
.\lab\bin\kind.exe delete cluster --name cks-lab
|
|
```
|