Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Linux Foundation CKS Exam - Topic 6 Question 66 Discussion

You can switch the cluster/configuration context using the following command: [desk@cli] $kubectl config use-context dev A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.Task: Create a new default-deny NetworkPolicy nameddeny-networkin the namespacetestfor all traffic of type Ingress + EgressThe new NetworkPolicy must deny all Ingress + Egress traffic in the namespacetest.Apply the newly createddefault-denyNetworkPolicy to all Pods running in namespacetest.You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml
A) Explanation: master1 $k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing $vim netpol.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-network namespace: test spec: podSelector: {} policyTypes: - Ingress - Egress master1 $k apply -f netpol.yaml Explanation controlplane $ k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing master1 $ vim netpol1.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-network namespace: test spec: podSelector: {} policyTypes: - Ingress - Egress master1 $ k apply -f netpol1.yaml Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/ Explanation controlplane $ k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing master1 $ vim netpol1.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-network namespace: test spec: podSelector: {} policyTypes: - Ingress - Egress master1 $ k apply -f netpol1.yaml Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/

Linux Foundation CKS Exam - Topic 6 Question 66 Discussion

Actual exam question for Linux Foundation's CKS exam
Question #: 66
Topic #: 6
[All CKS Questions]

You can switch the cluster/configuration context using the following command: [desk@cli] $kubectl config use-context dev A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

Task: Create a new default-deny NetworkPolicy nameddeny-networkin the namespacetestfor all traffic of type Ingress + Egress

The new NetworkPolicy must deny all Ingress + Egress traffic in the namespacetest.

Apply the newly createddefault-denyNetworkPolicy to all Pods running in namespacetest.

You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml

Show Suggested Answer Hide Answer
Suggested Answer: A

by Jesusita at Sep 17, 2024, 02:06 AM

Limited Time Offer

25%

Off

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Gregg
10 months ago
I thought you could still allow some traffic with exceptions?
upvoted 0 times
...
Bernardo
10 months ago
Yup, that's how you keep things secure in Kubernetes!
upvoted 0 times
...
Darell
10 months ago
Wait, does this really block all traffic? Seems a bit extreme.
upvoted 0 times
...
Gennie
10 months ago
Totally agree, default-deny is a must for security!
upvoted 0 times
...
Mel
11 months ago
Just a reminder, the command to switch context is `kubectl config use-context dev`.
upvoted 0 times
...
Kayleigh
11 months ago
I feel like I’ve seen the command to apply the policy before, but I hope I remember the right file name when I apply it.
upvoted 0 times
...
Alpha
11 months ago
I’m a bit confused about the difference between Ingress and Egress in the policy. Do I really need to list both types in the spec?
upvoted 0 times
...
Gerardo
11 months ago
I think we did a similar question where we had to deny traffic in a namespace. I just need to make sure I apply it correctly after editing the YAML file.
upvoted 0 times
...
Carylon
11 months ago
I remember we practiced creating a default-deny NetworkPolicy, but I’m not sure if I need to specify any pod selectors or just leave it empty.
upvoted 0 times
...
Brett
11 months ago
I'm feeling confident about this one. I'll create the NetworkPolicy, set the correct namespace, and apply it to the test environment. Should be a straightforward task.
upvoted 0 times
...
Lorita
11 months ago
This seems like a pretty standard NetworkPolicy task. I'll follow the steps outlined in the question and use the provided skeleton file to get it done.
upvoted 0 times
...
Leonida
11 months ago
Okay, I think I've got a good understanding of what I need to do. I'll create the NetworkPolicy, making sure to deny both Ingress and Egress traffic, and apply it to the test namespace.
upvoted 0 times
...
Rebeca
11 months ago
Hmm, I'm a bit unsure about the exact syntax for the NetworkPolicy. Let me double-check the documentation to make sure I get the details right.
upvoted 0 times
...
Kayleigh
12 months ago
This looks straightforward. I'll create the NetworkPolicy manifest file based on the provided skeleton and apply it to the test namespace.
upvoted 0 times
...
Svetlana
12 months ago
I think the concept we need here is related to access control, but did we ever cover "Deny URL"? That sounds familiar too.
upvoted 0 times
...
Albert
2 years ago
Hold on, let me double-check the NetworkPolicy syntax. Ah, got it! This is a classic Kubernetes networking question. Time to put my skills to the test.
upvoted 0 times
Lajuana
2 years ago
User2
upvoted 0 times
...
Brandee
2 years ago
User1
upvoted 0 times
...
...
Matthew
2 years ago
Yes, following the steps in the reference link can guide us through the process.
upvoted 0 times
...
Kenneth
2 years ago
I agree, but the explanation provided with the manifest file is helpful.
upvoted 0 times
...
German
2 years ago
Haha, this is like a walk in the park. The trick is to remember that a default-deny NetworkPolicy is the way to go when there's no other policy defined. Just follow the steps and you're golden.
upvoted 0 times
Jeannetta
2 years ago
Following the steps makes it easy.
upvoted 0 times
...
Hui
2 years ago
Remember to deny all Ingress + Egress traffic in the namespace test.
upvoted 0 times
...
Valentin
2 years ago
Just create the new NetworkPolicy and apply it to the Pods.
upvoted 0 times
...
Oretha
2 years ago
I agree, default-deny NetworkPolicy is the key.
upvoted 0 times
...
...
Matthew
2 years ago
I think the question about creating a default-deny NetworkPolicy is tricky.
upvoted 0 times
...
Carlota
2 years ago
Easy peasy! Just run the `k get pods -n test --show-labels` command to see the pods, then create the NetworkPolicy YAML and apply it. Boom, job done!
upvoted 0 times
Annmarie
2 years ago
No problem, happy to help!
upvoted 0 times
...
Theodora
2 years ago
Thanks for the tip! I'll give that a try.
upvoted 0 times
...
...

Save Cancel