Lesson 10 Lab - Using Network Policies

Objective: Create a network policy that only allows sleepybox1 to access the nginx web server running inside the restricted namespace.

Step 1 - Create Namespace

kubectl create namespace restricted

Step 2 - Verify Namespace

kubectl get ns
Verifyab-step

Step 3 - Create NGINX Pod

kubectl run lab10server -n restricted --image=nginx

Step 4 - Expose Service

kubectl expose pod lab10server -n restricted --port=80

Step 5 - Create Test Pods

kubectl run sleepybox1 --image=busybox -- sleep 3600

kubectl run sleepybox2 --image=busybox -- sleep 3600

Step 6 - Add Labels

Label the namespace and sleepybox1.

kubectl label ns default project=myproject

kubectl label pod sleepybox1 role=access

Step 7 - Create Network Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: restricted
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          project: myproject
      podSelector:
        matchLabels:
          role: access

Step 8 - Apply Policy

kubectl apply -f networkpolicy.yaml

Step 9 - Verify Policy

kubectl get netpol -n restricted

Step 10 - Test Connectivity

sleepybox1 should work:

kubectl exec sleepybox1 -- wget -qO- --timeout=2 lab10server.restricted

sleepybox2 should fail:

kubectl exec sleepybox2 -- wget -qO- --timeout=2 lab10server.restricted

CKA Exam Tips

- namespaceSelector
  podSelector
Means: Namespace AND Pod 
- namespaceSelector

- podSelector
Means: Namespace OR Pod

Understanding Kubernetes Service DNS

During the lab, both of the following commands successfully reached the nginx web server: 

kubectl exec sleepybox1 -- wget -qO- lab10server.restricted

kubectl exec sleepybox1 -- wget -qO- lab10server.restricted.svc.cluster.local

This happens because Kubernetes automatically creates DNS records for Services.

Full Service DNS Name

lab10server.restricted.svc.cluster.local

Kubernetes uses the following format for Service DNS entries: 

<service-name>.<namespace>.svc.cluster.local

For this lab: 

Service Name: lab10server
Namespace:   restricted

DNS Name:
lab10server.restricted.svc.cluster.local

Why the Short Name Works

Pods automatically receive DNS search domains. Kubernetes will try to resolve shorter names into the full DNS name.

Therefore: 

lab10server.restricted

automatically expands to: 

lab10server.restricted.svc.cluster.local

behind the scenes.

Check DNS Configuration

You can view the DNS search domains configured for a pod: 

kubectl exec sleepybox1 -- cat /etc/resolv.conf

Example output: 

search default.svc.cluster.local svc.cluster.local cluster.local

Common Service Name Formats

CKA Exam Tip

Most exam questions and real-world administrators use: 
lab10server.restricted
because it is shorter and easier to type, but both names resolve to the same Kubernetes Service.
Key Takeaway:

sleepybox1 can connect because: sleepybox2 is blocked because it does not have the role=access label. This demonstrates how NetworkPolicies can combine namespaceSelector and podSelector using AND logic.

Alternative Connectivity Test Using wget --spider

Instead of downloading the entire nginx page, we can simply test connectivity using wget --spider. 

kubectl exec -it sleepybox1 -- \
wget --spider --timeout=1 \
lab10server.restricted.svc.cluster.local

Expected output:

Connecting to lab10server.restricted.svc.cluster.local (10.100.138.249:80)
remote file exists

The --spider option checks whether the resource is reachable without downloading the web page.

Benefits

If the NetworkPolicy blocks the connection, the command should time out instead of returning remote file exists.