Pick and Deploy the Least Permissive NetworkPolicy
Scenario
A two-tier application spread across three namespaces. Each of the three namespaces below carries the label name=<namespace>.
| Namespace | Workload - deployment | Pod labels |
|---|---|---|
frontend | frontend | app=frontend |
frontend | legacy-client | app=legacy |
backend | backend | app=backend |
other | external-client | app=external |
The backend Pods listen on two ports, 80 and 8080. The backend Service publishes both and does not remap them:
| Service port | Container port on the backend Pods |
|---|---|
80 | 80 |
8080 | 8080 |
Clients reach them at:
http://backend.backend.svc.cluster.local:80
http://backend.backend.svc.cluster.local:8080
Nothing is restricted yet. Every Pod in the cluster can reach both ports.
Task
The security team left five NetworkPolicy files in /home/laborant/network-policies on dev-machine:
/home/laborant/network-policies
├── policy-1.yaml
├── policy-2.yaml
├── policy-3.yaml
├── policy-4.yaml
└── policy-5.yaml
1 directory, 5 files
Exactly one file meets all of the requirements below. Apply it, unchanged.
- The
frontendDeployment's Pods reach the backend Pods on TCP80, and on no other port. - Every other source, in every namespace, is denied.
backendends up with exactly one NetworkPolicy: the one that grants the access above and nothing beyond it.
Required end state, only frontend Pods reach the backend on port 80.
Leave the manifests, Deployments, Pods, and namespace labels untouched. This task is about selection, not authoring.
Hint 1
Before comparing the files, read what each field means:
kubectl explain networkpolicy.spec.ingress.from
kubectl explain networkpolicy.spec.ingress.ports
Three things decide how wide a policy is:
fromis a list of source rules, one per-. A source is let in if it matches at least one source rule. Inside a single source rule, every selector present has to match that same source.- An omitted field is not a restriction. A missing
portslist means every port;podSelector: {}matches every Pod. - A
portsitem names a port on the Pods the policy protects. It is not the Service port, even when the two numbers happen to match.
Hint 2
A source rule that carries only a podSelector is evaluated within the namespace of the policy itself. Matching Pods in a different namespace takes a namespaceSelector in the same source rule.
Compare, for any one file, how many source rules its from list holds, whether a ports list is present at all, and which of the two selectors each source rule carries.
See: Network Policies