CKA Practice Exam: Part 3

Network policies are important for specifying which pods can talk to which. You can apply network policies to certain pods using their label selectors. In this part of the practice exam, you will be responsible for creating a `default-deny` policy, as well as explicitly stating communication over a certain port. This will simulate a possible exam question and have you show your expertise with pod communication and security.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Create a deployment and a service to expose your web front end.

Use the following command to create the YAML for your deployment:

kubectl create deployment webfront-deploy  --image=nginx:1.7.8  --dry-run -o yaml > webfront-deploy.yaml

Add container port 80, to have your final YAML look like this:

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: webfront-deploy
  name: webfront-deploy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webfront-deploy
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: webfront-deploy
    spec:
      containers:
      - image: nginx:1.7.8
        name: nginx
        resources: {}
        ports:
        - containerPort: 80
status: {}

Use the following command to create your deployment:
```
kubectl apply -f webfront-deploy.yaml
```
Use the following command to scale up your deployment:
```
kubectl scale deployment/webfront-deploy --replicas=2
```

Use the following command to create the YAML for a service:

kubectl expose deployment/webfront-deploy --port=80 --target-port=80 --type=NodePort --dry-run -o yaml > webfront-service.yaml

Add the name and the nodePort, the complete YAML will look like this:

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: null
  labels:
    app: webfront-deploy
  name: webfront-service
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30080
  selector:
    app: webfront-deploy
  type: NodePort
status:
  loadBalancer: {}

Use the following command to create the service:
```
kubectl apply -f webfront-service.yaml
```

Verify that you can communicate with your pod directly:

kubectl run busybox --rm -it --image=busybox /bin/sh

# wget -O- <pod_ip_address>:80
# wget --spider --timeout=1 webfront-service

Create a database server to serve as the backend database.

Use the following command to create a Redis pod:

kubectl run db-redis --image=redis --restart=Never

Create a network policy that will deny communication by default.

Use the following YAML (this is where you can use kubernetes.io and search "network policies" and then search for the text "default"):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Use the following command to apply the network policy:
```
kubectl apply -f default-deny.yaml
```

Verify that communication has been disabled by default:

kubectl run busybox --rm -it --image=busybox /bin/sh
# wget -O- ≤pod_ip_address>:80

Apply the labels and create a communication over port 6379 to the database server.

Use the following commands to apply the labels:

kubectl get po
kubectl label po <pod_name> role=frontend
kubectl label po db-redis role=db
kubectl get po --show-labels

Use the following YAML to create a network policy for the communication between the two labeled pods (copy from kubernetes.io website):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: redis-netpolicy
spec:
  podSelector:
    matchLabels:
      role: db
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - port: 6379

Use the following command to create the network policy:
```
kubectl apply -f redis-netpolicy.yaml
```
Use the following command to view the network policies:
```
kubectl get netpol
```
Use the following command to describe the custom network policy:
```
kubectl describe netpol redis-netpolicy
```
Use the following command to show the labels on the pods:
```
kubectl get po --show-labels
```

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

CKA Practice Exam: Part 3

About this Hands-on Lab

Learning Objectives

Additional Resources

What are Hands-on Labs

Newsletter