Challenge, Medium,  on  Kubernetes

Selective Pod-to-Pod Communication Using NetworkPolicies Under Default-Deny

Scenario

Two Pods are running in netpol-demo1: frontend (app=frontend) and backend (app=backend), both exposed on port 80.

By default, all traffic is blocked. Only DNS (port 53) is allowed. Your goal is to make frontend able to reach backend on port 80.

Task

Create two NetworkPolicies in the netpol-demo1 namespace:

1. allow-frontend-egress — targets frontend Pods (app=frontend). Allows outgoing traffic to backend Pods (app=backend) on TCP port 80.

2. allow-frontend — targets backend Pods (app=backend). Allows incoming traffic from frontend Pods (app=frontend) on TCP port 80.

kubectl exec -n netpol-demo1 frontend -- wget -qO- http://backend.netpol-demo1:80
# verify that frontend can reach backend on port 80

Do not modify or delete default-deny-all.

Hint

Use policyTypes: [Egress] for the frontend policy and policyTypes: [Ingress] for the backend policy.

See: Network Policies

Test Cases

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge restrict-pod-traffic-using-networkpol-1a2781a8

This will create a local copy of the challenge content in a directory named restrict-pod-traffic-using-networkpol-1a2781a8. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge restrict-pod-traffic-using-networkpol-1a2781a8

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge