Isolated CKS NetworkPolicy lab
This lab runs in the local Kind context kind-cks-lab, separate from the pre-existing monitoring-context cluster.
Scenario
api and intruder are clients. db serves HTTP on port 8080. The policy allows only pods labelled app=api to reach the database.
Repeat the proof
kubectl --context kind-cks-lab -n cks-lab exec api -- wget -qO- -T 5 http://db:8080
kubectl --context kind-cks-lab -n cks-lab exec intruder -- wget -qO- -T 5 http://db:8080
The first command must print database. The second must time out, which proves the denial.
Inspect the answer
kubectl --context kind-cks-lab -n cks-lab get networkpolicy db-only-from-api -o yaml
kubectl --context kind-cks-lab -n cks-lab get pods --show-labels
The policy is in networkpolicy-lab.yaml. Edit it for new drills, then run:
kubectl --context kind-cks-lab apply -f .\lab\networkpolicy-lab.yaml
Cleanup
This is destructive and removes only the isolated Kind cluster:
.\lab\bin\kind.exe delete cluster --name cks-lab