Issues Passing Task #4/5 in Kubernetes Networking Lab: NetworkPolicy for Backup Server to Database Ingress

[henrylaurentkhosasih]

Hello everyone,

I have encountered an issue while working on Task #4 out of 5 in the Kubernetes Networking lab on KodeKloud. This task requires creating a NetworkPolicy that allows the database pod to receive ingress traffic on port 3306 from the backup pod in the backup-system namespace.

https://learn.kodekloud.com/user/courses/kubernetes-networking/module/5eea49e6-caea-4e84-88a0-268ea6f263af/lesson/b1f38672-72af-445d-8fc9-6ede055cdd10

The solution provided in the lab is as follows:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backup-ingress-to-database
  namespace: database
spec:
  podSelector:
    matchLabels:
      app: database
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: backup-system
        - podSelector:
            matchLabels:
              role: backup-system
      ports:
        - protocol: TCP
          port: 3306
  policyTypes:
    - Ingress

However, my solution is structured like this:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backup-ingress-to-database
  namespace: database
spec:
  podSelector:
    matchLabels:
      role: database
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          role: backup-system
      podSelector: # use AND instead of OR
        matchLabels:
          role: backup # use backup instead of backup-system
    ports:
    - protocol: TCP
      port: 3306
  policyTypes:
  - Ingress

In this case, the namespace is indeed labeled as backup-system, but the pods within that namespace are labeled with role=backup, as confirmed by running:

kubectl get pods -n backup-system --show-labels

Given this discrepancy, I am uncertain why my solution did not pass the test while the provided solution included a podSelector with a label that does not exist.

If anyone has encountered a similar issue or can offer insight into this situation, I would greatly appreciate your assistance! Thank you!

[Santosh_KodeKloud]

Hi @henrylaurentkhosasih

This question is similar to the 3rd Q for allowing traffic between the website and database which uses two elements in the - from OR block.

The issue seems to arise from the from field in the ingress rules. The first policy only allows ingress from pods labeled role: backup-system in backup-system ns, while the second policy permits traffic from all pods in the backup-system namespace OR from Pods in database ns with role: backup-system label.

IMO, the question can be rephrased appropriately, I will raise this concern with our lab team for further clarification and potential rephrasing of the question.

Regards.