Lab 6.6 - Question 3

adzee95

Question 3 of Lab 6.6 asks: Create a new NetworkPolicy called netblock which blocks all traffic to pods in this deployment only. Test that all traffic is blocked to deployment.

However, no matter what I do, external traffic is always allowed - And this makes sense to me, since I understood that NetworkPolicy resource doesn't involve external traffic. What does the question want then? Test that all traffic from within the cluster to the deployment is blocked, but external connections are still possible? I can achieve this easily using the taught material. However, blocking external traffic on an ingress networkpolicy doesn't seem possible.

How did you guys solve this?

adzee95

Bumping this question, as much newer questions have been answered already.

chrispokorni

Hi @adzee95,

I carefully read question #3 from lab 6.6. It was correctly quoted above, and indeed, it asks for a network policy that blocks all traffic to the pods of the deployment (deployment created for question #1 of lab 6.6).

Now I am reading your reasoning about the "external" traffic, that it is always allowed. And yes, that is correct, the network policy does not directly block "external" traffic to the pod. It can be achieved, but that means to introduce artifacts that seem to be out of the scope of this question.

At this point, please read question #3 again. There is no mention of "external" in the question. It simply asks to block traffic to the pods of the deployment. If not "external", then what other sources of traffic can you block with the policy?

Where you able to create a policy for this question? Did it block traffic to the pods? Where you able to test and validate the policy?

Regards,
-Chris