What is Kubernetes ?

Kubernetes is an open-source platform designed to automate deploying, scaling, and operating application containers.

• Think of Kubernetes as a warehouse manager for software.

Imagine you run a food delivery business:

Your food is the software application.
The kitchen workers are the computers running the software.
The customers are the people using the application.
As your business grows, a lot can go wrong:

A worker gets sick (a computer fails).
Too many orders arrive at once (high traffic).
You need more workers during lunch rush (scaling up).
You need to replace workers without stopping deliveries (software updates).
Instead of having a human manager coordinate everything, you hire an incredibly efficient supervisor. That supervisor is Kubernetes.

What Kubernetes does
Kubernetes automatically:

✅ Starts applications when needed

✅ Keeps the right number of copies running

✅ Replaces failed computers or application instances

✅ Distributes work across available machines

✅ Adds more capacity when demand increases

✅ Updates applications with minimal downtime

A simple analogy
If a website were a restaurant:

Application = the restaurant
Containers = individual chefs preparing food
Kubernetes = the restaurant manager who makes sure enough chefs are working, replaces chefs who leave, and moves people around when it gets busy
The restaurant owner doesn't need to constantly watch every chef. Kubernetes handles that automatically.

Why companies use it
Large companies may have hundreds or thousands of applications running across many servers. Manually managing all of that would be nearly impossible.

Kubernetes helps them:

Keep applications available 24/7
Handle sudden spikes in users
Recover quickly from failures
Reduce manual work for IT and engineering teams
In one sentence
Kubernetes is a system that automatically manages and coordinates large numbers of application containers, making sure software stays running, scales when needed, and recovers from problems without human intervention.

Lab Goal

• Create an nginx web server named lab10server in the restricted namespace.
• Create two BusyBox pods in the default namespace.
• Allow only sleepbox1 to access the nginx server.
• Block all other traffic.

Step By Step

kubectl create deploy test --image=nginx --dry-run=client -o yaml > test-deploy.yaml

Step 1: Create the Namespace

Create the restricted namespace.

kubectl create namespace restricted

Verify that the namespace was created successfully.

kubectl get ns

Step 2: Create the nginx webservere

Run a webserver with the name lab10server in Namespace restricted, using the Nginx image and ensure it is exposed by a Service.

kubectl create deployment lab10server --image=nginx -n restricted

verify

kubectl get all -n restricted

Step 3: Expose it with a Service

kubectl expose deployment lab10server --port=80 --target-port=80 -n restricted

verfiy

kubectl get svc -n restricted

Step 4 & Step 5: Create sleepybox1 - then repeat for sleepbox2

kubectl run sleepybox1 --image=busybox --restart=Never -- sleep 3600

verify

kubectl get pod sleepybox1

Step 6: Test connectivity before creating NetworkPolicy

Get service name:

kubectl get svc -n restricted

Test from sleepybox1:

kubectl exec sleepybox1 -- wget -qO- lab10server.restricted

Test from sleepybox2:

kubectl exec sleepybox2 -- wget -qO- lab10server.restricted

Step 7: Label sleepybox1

NetworkPolicies work best with labels.

Label sleepybox1:

kubectl label pod sleepybox1 access=allowed

Verify:

kubectl get pods --show-labels

Step 8: Create the NetworkPolicy

vim networkpolicy.yaml

NetworkPolicy YAML

📋 Copy YAML

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-sleepybox1
  namespace: restricted
spec:
  podSelector: {}
  policyTypes:
  - Ingress

  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: default
      podSelector:
        matchLabels:
          access: allowed

paste:

Understanding the YAML

This means:

Step 9: Apply the policy

kubectl apply -f networkpolicy.yaml

Step 10: Test access again

kubectl exec sleepybox1 -- wget -qO- --timeout=2 lab10server.restricted

should be successful with sleepybox1 - Expected sleepbox2 ❌ Timeout / connection failure

Traffic Flow

NetworkPolicy Logic

NetworkPolicy Mapping

                podSelector:
                  matchLabels:
                    app: nginx
                

Protects the nginx server pod.

                namespaceSelector:
                  matchLabels:
                    kubernetes.io/metadata.name: default
                

Traffic must come from the default namespace.

                podSelector:
                  matchLabels:
                    access: allowed
                

Traffic must come from pods explicitly labeled access=allowed.

CKA Exam Memory Trick

Whenever you see a NetworkPolicy question, draw:

                SOURCE -----------> DESTINATION
                

                sleepbox1 --------> lab10server ✅
                
                sleepybox2 -------> lab10server ❌
                

Then answer:

1. What am I protecting?
2. Who should be allowed?
3. How can I identify the allowed source (label, namespace, IP)?

Build the NetworkPolicy from those answers.