Tasks

Loading tasks...

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge, Medium, on Kubernetes, Networking

Enforce a NetworkPolicy to Block All Traffic Except DNS

Scenario

A Pod named isolated exists in namespace netpol-demo2 with label app=isolated. Your organization requires this Pod to be fully isolated from the cluster network.

Task

Create a NetworkPolicy named isolate-pod that applies to the isolated Pod with the following rules:

Deny all incoming traffic to the Pod
Block all outgoing traffic from the Pod, except DNS queries on port 53 using both UDP and TCP
Verify from the isolated Pod that DNS resolution for the Service nginx-svc.default works using nslookup.

kubectl exec isolated -n netpol-demo2 -- \
nslookup nginx-svc.default.svc.cluster.local   
# ==> Return the ClusterIP of nginx-svc from the default namespace.

kubectl exec isolated -n netpol-demo2 -- \
wget -qO- --timeout=5 http://nginx-svc.default.svc.cluster.local  
# ==> Attempt to connect to nginx-svc — connection refused

Hint 1

DNS queries use port 53. Without allowing DNS egress, the Pod cannot resolve any Service names — even nslookup will fail. Both UDP and TCP must be allowed on port 53 because DNS uses UDP by default but falls back to TCP for large responses.

Use podSelector with matchLabels: app: isolated to target the Pod. Name the NetworkPolicy isolate-pod. Set policyTypes to both Ingress and Egress. Leave the ingress field empty to deny all incoming traffic. Under egress, each protocol must be its own entry with both port: 53 and protocol set together:

egress:
- ports:
  - port: 53
    protocol: UDP
  - port: 53
    protocol: TCP

See the official docs: Network Policies

Test Cases

Start challenge