Lesson in CKA Mock Exam
Question 5: Allow Frontend to Reach Backend Under Default Deny
A namespace already has default-deny and two nginx Pods. Open only the path from frontend to backend on port 8080.
Scenario
Namespace netpol-demo is already set up with:
| Pod | Label | Port |
|---|---|---|
frontend | app=frontend | 80 |
backend | app=backend | 8080 |
Both Pods run nginx.
A NetworkPolicy named default-deny-all blocks all pod traffic in the namespace. DNS (port 53) is still allowed so Pods can resolve Service names.
As a result, frontend cannot reach backend right now.
Your task
Create the NetworkPolicy(ies) needed so frontend can talk to backend on TCP port 8080.
Requirements:
- Do not modify or delete
default-deny-all - Use the
applabels in your selectors - Allow only the traffic required for frontend → backend:8080
Hint
With default deny, traffic is blocked in both directions. Think about what frontend needs to send out, and what backend needs to accept in.
- Previous lesson
- Question 4: Inspect a Container with crictl
- Next lesson
- Question 6: Multi-Container Deployment