Let One Namespace In

medium 20 XP ~9 minHands-on lab

The namespace booking has a default-deny policy for incoming traffic. The monitoring team runs a scraper in the namespace finance that must collect metrics from the api Pods.

Task

Create one NetworkPolicy allow-metrics in booking.
Pods labelled app=scraper in the namespace finance can reach Pods labelled app=api in booking on TCP port 9090.
Nothing else gets in: not other Pods in finance, not app=scraper Pods in other namespaces, and not other ports.
Keep the existing default-deny-ingress policy.

Start with kubectl get netpol -n booking and kubectl get ns finance --show-labels.

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

networkpolicy namespaces network-security cka