The Policy That Lets Nothing In

medium 20 XP ~8 minHands-on lab

catalogs denies all incoming traffic by default. The policy audit-log-from-frontend is supposed to make one exception: the frontend Pods of the web team's namespace dispatch may call audit-log on TCP port 9000. Yet every request from frontend times out.

Task

Pods labelled app=frontend in dispatch reach audit-log in catalogs on TCP 9000.
Nothing else is let in: not other Pods of dispatch, not Pods of catalogs, not app=frontend Pods of other namespaces, and no other port.
Keep default-deny-ingress as it is.

The web team's namespaces carry the label team=web. Start with kubectl describe networkpolicy -n catalogs.

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

troubleshooting networkpolicy selectors namespaces cka