Ultimate Mock | Network Policy

Kubernetes
#1

Not sure, What wrong i did. Created NP as per guidelines, still did not work. My Ans. Considered wrong

Screenshot 2023-08-03 193006
Screenshot 2023-08-03 1930061920×1080 312 KB

Screenshot 2023-08-03 200256
Screenshot 2023-08-03 2002561920×1080 260 KB

Please help

#2

Your policy is incorrect. There is a very subtle difference between what is shown in your screenshot and the given answer to the left.

#3

please help in resolving, I tried many things…

#4

You don’t see the issue?

Your solution

- from:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: default
  - podSelector:
      matchLabels:
        app: cyan-white-cka28-trb

Given solution

- from:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: default
    podSelector:
      matchLabels:
        app: cyan-white-cka28-trb

Still don’t see it?

#5

Ok, I got it, Thanks for pointing, will check and get back.

#6

Know the following

  1. Each rule in the policy begins with -
  2. Each rule can have one or more of namespaceSelector and podSelector
  3. Within a single rule, the various selectors are ANDed together
  4. Multiple rules are ORed together.

Your solution reads as follows:

ALL pods in namespace default
-OR-
ANY pod with label app=cyan-white-cka28-trb in CURRENT namespace (namespace where the policy is created)

This is why cyan-black-cka28-trb still has access - because it matches "ALL pods in namespace default ". If a rule does not have a namespace selector, then it applies to the namespace where the policy is created.

Given solution reads

Pods in namespace default
-AND-
has label app=cyan-white-cka28-trb

Therefore only that pod can access.

#8

The question actually has a type in the pod name, in the lab env there is no cyan-white-cka28-trb1 pod created but the pod name is cyan-white-cka28-trb. This can be fixed by your team.

#9

I have reported the typo.
Thanks