Lab 6.5 with Netpol

Hi
I am trying to get a handle on network policies. I have used the Kubernetes.io documentation link on network policies and in the end it document referred here as recipes:
https://github.com/ahmetb/kubernetes-network-policy-recipes
This is exhaustive list and I was able to practice with everything here. A few questions I have:
a) Can I access the above document while taking the test?
b) I was tearing my hair apart while working on the policies in Lab 6.5 and default from within cluster I was able to use both pod IP and cluster IP and access the web page even though the policy was deny-default. Same with ping - even though ICMP was expected to be blocked it worked always. This is with both Cilium and Calico CNI plugins.
Not sure if I understood the comment under step 10 of lab 6.4 correctly for Pod Selector. In the policy Pod Selector is wild carded "{}"
Can you please help?
Rama
Comments
-
Once I put in pod selector as below in the allclosed.yaml file:
spec:
podSelector:
matchLabels:
example: secondThen ping got blocked. I went back and checked the network-policies-recipes and sure enough in deny-default there was pod selector and that appeared to be a difference maker.
One thing I struggled with - I need to validate by proof - meaning the dropped ICMP packets or any other protocols I want to see in a log but other than iptables level log I could not think of anything else.
Appreciate any thoughts on both Pod Selector and iptables log.
0 -
Hi @prama01886,
For a list of allowed resources during the CKAD cert exam, I recommend inspecting the rules and policies site, from where you can launch a list of allowed tools and resources specific to CKAD.
Not sure if I understood the comment under step 10 of lab 6.4 correctly for Pod Selector...
In the latest lab book release, I could not locate the comment you are referring to.
You may compare the default allow with default deny policy examples form the documentation to learn about the usage of the double curly-brackets "{ }" and their effects with
podSelector
,egress
, andingress
descriptors.You can validate your network policy by attempting to send traffic to or from the isolated application. If your requests time out, that is proof that the policy is doing what it was supposed to do. You can also listen from the isolated container, and validate that no unexpected traffic has reached the port that is blocked by the policy.
Regards,
-Chris0
Categories
- 10K All Categories
- 29 LFX Mentorship
- 82 LFX Mentorship: Linux Kernel
- 473 Linux Foundation Boot Camps
- 268 Cloud Engineer Boot Camp
- 96 Advanced Cloud Engineer Boot Camp
- 44 DevOps Engineer Boot Camp
- 32 Cloud Native Developer Boot Camp
- 1 Express Training Courses
- 1 Express Courses - Discussion Forum
- 1.6K Training Courses
- 18 LFC110 Class Forum
- 4 LFC131 Class Forum
- 19 LFD102 Class Forum
- 133 LFD103 Class Forum
- 9 LFD121 Class Forum
- 60 LFD201 Class Forum
- LFD210 Class Forum
- 1 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum
- 23 LFD254 Class Forum
- 545 LFD259 Class Forum
- 100 LFD272 Class Forum
- 1 LFD272-JP クラス フォーラム
- 1 LFS145 Class Forum
- 20 LFS200 Class Forum
- 739 LFS201 Class Forum
- 1 LFS201-JP クラス フォーラム
- 1 LFS203 Class Forum
- 38 LFS207 Class Forum
- 296 LFS211 Class Forum
- 53 LFS216 Class Forum
- 45 LFS241 Class Forum
- 40 LFS242 Class Forum
- 33 LFS243 Class Forum
- 10 LFS244 Class Forum
- 27 LFS250 Class Forum
- 1 LFS250-JP クラス フォーラム
- 131 LFS253 Class Forum
- 968 LFS258 Class Forum
- 10 LFS258-JP クラス フォーラム
- 86 LFS260 Class Forum
- 124 LFS261 Class Forum
- 29 LFS262 Class Forum
- 78 LFS263 Class Forum
- 15 LFS264 Class Forum
- 10 LFS266 Class Forum
- 17 LFS267 Class Forum
- 16 LFS268 Class Forum
- 14 LFS269 Class Forum
- 195 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- 207 LFW211 Class Forum
- 149 LFW212 Class Forum
- 892 Hardware
- 213 Drivers
- 74 I/O Devices
- 44 Monitors
- 115 Multimedia
- 206 Networking
- 100 Printers & Scanners
- 85 Storage
- 747 Linux Distributions
- 88 Debian
- 64 Fedora
- 13 Linux Mint
- 13 Mageia
- 24 openSUSE
- 133 Red Hat Enterprise
- 33 Slackware
- 13 SUSE Enterprise
- 354 Ubuntu
- 469 Linux System Administration
- 38 Cloud Computing
- 68 Command Line/Scripting
- Github systems admin projects
- 93 Linux Security
- 77 Network Management
- 107 System Management
- 48 Web Management
- 62 Mobile Computing
- 22 Android
- 26 Development
- 1.2K New to Linux
- 1.1K Getting Started with Linux
- 524 Off Topic
- 127 Introductions
- 210 Small Talk
- 19 Study Material
- 783 Programming and Development
- 257 Kernel Development
- 492 Software Development
- 919 Software
- 255 Applications
- 181 Command Line
- 2 Compiling/Installing
- 76 Games
- 316 Installation
- 46 All In Program
- 46 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)