my page
AKS / ASP .NET
CKA Network lab2 Test task
© 2026 Janella Codes. All rights reserved

CKA NetworkPolicy Lab 10

☸️ Kubernetes CKA Study Guide • NetworkPolicy Lab 10

Allow only one pod to access the nginx server

Lab Goal

  • Create an nginx web server named lab10server in the restricted namespace.
  • Create two BusyBox pods in the default namespace.
  • Allow only sleepbox1 to access the nginx server.
  • Block all other traffic.

Step By Step

Step 1: Create the Namespace

Create the restricted namespace.

kubectl create namespace restricted

Verify that the namespace was created successfully.

kubectl get ns

Step 2: Create the nginx webservere

Run a webserver with the name lab10server in Namespace restricted, using the Nginx image and ensure it is exposed by a Service.

kubectl create deployment lab10server --image=nginx -n restricted

verify

kubectl get all -n restricted

Step 3: Expose it with a Service

kubectl expose deployment lab10server --port=80 --target-port=80 -n restricted

verfiy

kubectl get svc -n restricted

Step 4 & Step 5: Create sleepybox1 - then repeat for sleepbox2

kubectl run sleepybox1 --image=busybox --restart=Never -- sleep 3600

verify

kubectl get pod sleepybox1

Step 6: Test connectivity before creating NetworkPolicy

Get service name:

kubectl get svc -n restricted

Test from sleepybox1:

kubectl exec sleepybox1 -- wget -qO- lab10server.restricted

Test from sleepybox2:

kubectl exec sleepybox2 -- wget -qO- lab10server.restricted

Step 7: Label sleepybox1

NetworkPolicies work best with labels.


Label sleepybox1:


kubectl label pod sleepybox1 access=allowed

Verify:

kubectl get pods --show-labels

Step 8: Create the NetworkPolicy

vim networkpolicy.yaml

NetworkPolicy YAML

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-sleepybox1
  namespace: restricted
spec:
  podSelector: {}
  policyTypes:
  - Ingress

  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: default
      podSelector:
        matchLabels:
          access: allowed

paste:

Understanding the YAML


This means:





Step 9: Apply the policy

kubectl apply -f networkpolicy.yaml

Step 10: Test access again

kubectl exec sleepybox1 -- wget -qO- --timeout=2 lab10server.restricted

should be successful with sleepybox1 - Expected sleepbox2 ❌ Timeout / connection failure

Traffic Flow

Namespace: default
sleepbox1
access=allowed
✅ ➜
Namespace: restricted
lab10server
app=nginx


Namespace: default
sleepybox2
No Access Label
❌ ➜
Namespace: restricted
lab10server
app=nginx

NetworkPolicy Logic

Incoming request arrives at lab10server

Is the source pod in the default namespace?

YES ➜ Does the pod have access=allowed?

YES ➜ ✅ ALLOW
NO ➜ ❌ DENY

Any other namespace ➜ ❌ DENY

NetworkPolicy Mapping

                podSelector:
                  matchLabels:
                    app: nginx

Protects the nginx server pod. 

                namespaceSelector:
                  matchLabels:
                    kubernetes.io/metadata.name: default

Traffic must come from the default namespace. 

                podSelector:
                  matchLabels:
                    access: allowed

Traffic must come from pods explicitly labeled access=allowed.

CKA Exam Memory Trick

Whenever you see a NetworkPolicy question, draw: 

                SOURCE -----------> DESTINATION
                
                sleepbox1 --------> lab10server ✅
                
                sleepybox2 -------> lab10server ❌

Then answer:

  1. What am I protecting?
  2. Who should be allowed?
  3. How can I identify the allowed source (label, namespace, IP)?

Build the NetworkPolicy from those answers.

picture of Nanonauts

Thank you for visiting
a little about myself
I go above and beyond
I take great pride developing best quality apps web pages
I started back in 2004 when I took my first programming class it was .net and Java.
I love building software and/or adding new features to existing apps/web pages.
If you are interested I would very much enjoy hearing about your project and how I can help you achieve your goals For more info click Here



Some of my recent projects



A Receipe/cooking adventure



Janella Vanilla 😁🥂🍉😋🥝🍒





A place where users can build their own stock portfolio and make comments on their favorite stocks or trash their not so favorite stocks.



Princess Stocks





A Social media app that allows users to post comments, like and comment on other users posts.



Camp Threads





A web page that allows users to comment on various business/services. A project that was part of a javaScript training series



Corp Comment

A grocery or to do list app that allows users to add items to a list and check them off when completed.



Todo List

a Pacman game that allows users to play the game and keep track of their score and uses some AI to have the ghosts "chase" Pacman.



Pacman





A side scroller game with a little doggie dodging enemies



Doggie game





Rainbow Matrix rain



Rainbow Matrix





A profile page that shows me and some of my projects and my resume.



React Portfolio





Back to top