Lab 6.5 with Netpol

prama01886

Hi

I am trying to get a handle on network policies. I have used the Kubernetes.io documentation link on network policies and in the end it document referred here as recipes:

https://github.com/ahmetb/kubernetes-network-policy-recipes

This is exhaustive list and I was able to practice with everything here. A few questions I have:
a) Can I access the above document while taking the test?

b) I was tearing my hair apart while working on the policies in Lab 6.5 and default from within cluster I was able to use both pod IP and cluster IP and access the web page even though the policy was deny-default. Same with ping - even though ICMP was expected to be blocked it worked always. This is with both Cilium and Calico CNI plugins.

Not sure if I understood the comment under step 10 of lab 6.4 correctly for Pod Selector. In the policy Pod Selector is wild carded "{}"

Can you please help?

Rama

prama01886

Once I put in pod selector as below in the allclosed.yaml file:
spec:
podSelector:
matchLabels:
example: second

Then ping got blocked. I went back and checked the network-policies-recipes and sure enough in deny-default there was pod selector and that appeared to be a difference maker.

One thing I struggled with - I need to validate by proof - meaning the dropped ICMP packets or any other protocols I want to see in a log but other than iptables level log I could not think of anything else.

Appreciate any thoughts on both Pod Selector and iptables log.

chrispokorni

Hi @prama01886,

For a list of allowed resources during the CKAD cert exam, I recommend inspecting the rules and policies site, from where you can launch a list of allowed tools and resources specific to CKAD.

Not sure if I understood the comment under step 10 of lab 6.4 correctly for Pod Selector...

In the latest lab book release, I could not locate the comment you are referring to.

You may compare the default allow with default deny policy examples form the documentation to learn about the usage of the double curly-brackets "{ }" and their effects with podSelector, egress, and ingress descriptors.

You can validate your network policy by attempting to send traffic to or from the isolated application. If your requests time out, that is proof that the policy is doing what it was supposed to do. You can also listen from the isolated container, and validate that no unexpected traffic has reached the port that is blocked by the policy.

Regards,
-Chris