Linux Foundation CKS Exam - Topic 6 Question 66 Discussion

Question

You can switch the cluster/configuration context using the following command:
[desk@cli] $kubectl config use-context dev

A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.Task: Create a new default-deny NetworkPolicy nameddeny-networkin the namespacetestfor all traffic of type Ingress + EgressThe new NetworkPolicy must deny all Ingress + Egress traffic in the namespacetest.Apply the newly createddefault-denyNetworkPolicy to all Pods running in namespacetest.You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml

Jesusita · Accepted Answer

A) Explanation:
master1 $k get pods -n test --show-labels
NAME        READY    STATUS     RESTARTS     AGE       LABELS
test-pod    1/1      Running       0         34s      role=test,run=test-pod
testing     1/1      Running       0         17d      run=testing
$vim netpol.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $k apply -f netpol.yaml
Explanation
controlplane $ k get pods -n test --show-labels
NAME        READY    STATUS     RESTARTS     AGE       LABELS
test-pod    1/1      Running       0         34s      role=test,run=test-pod
testing     1/1      Running       0         17d      run=testing
master1 $ vim netpol1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol1.yaml

Reference:
https://kubernetes.io/docs/concepts/services-networking/network-policies/
Explanation
controlplane $ k get pods -n test --show-labels
NAME        READY    STATUS     RESTARTS     AGE       LABELS
test-pod    1/1      Running       0         34s      role=test,run=test-pod
testing     1/1      Running       0         17d      run=testing
master1 $ vim netpol1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol1.yaml

Reference:
https://kubernetes.io/docs/concepts/services-networking/network-policies/