Lab
A Cloud Guru

CKA Practice Exam: Part 3

Network policies are important for specifying which pods can talk to which. You can apply network policies to certain pods using their label selectors. In this part of the practice exam, you will be responsible for creating a `default-deny` policy, as well as explicitly stating communication over a certain port. This will simulate a possible exam question and have you show your expertise with pod communication and security.

Try for free Contact sales

Path Info

Level

Intermediate

Duration

1h 30m

Published

Mar 31, 2019

Challenge

Create a deployment and a service to expose your web front end.

Use the following command to create the YAML for your deployment:

kubectl create deployment webfront-deploy  --image=nginx:1.7.8  --dry-run -o yaml > webfront-deploy.yaml

Add container port 80, to have your final YAML look like this:

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: webfront-deploy
  name: webfront-deploy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webfront-deploy
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: webfront-deploy
    spec:
      containers:
      - image: nginx:1.7.8
        name: nginx
        resources: {}
        ports:
        - containerPort: 80
status: {}

Use the following command to create your deployment:
```
kubectl apply -f webfront-deploy.yaml
```

Use the following command to scale up your deployment:

kubectl scale deployment/webfront-deploy --replicas=2

Use the following command to create the YAML for a service:

kubectl expose deployment/webfront-deploy --port=80 --target-port=80 --type=NodePort --dry-run -o yaml > webfront-service.yaml

Add the name and the nodePort, the complete YAML will look like this:

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: null
  labels:
    app: webfront-deploy
  name: webfront-service
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30080
  selector:
    app: webfront-deploy
  type: NodePort
status:
  loadBalancer: {}

Use the following command to create the service:
```
kubectl apply -f webfront-service.yaml
```

Verify that you can communicate with your pod directly:

kubectl run busybox --rm -it --image=busybox /bin/sh

# wget -O- <pod_ip_address>:80
# wget --spider --timeout=1 webfront-service

Challenge

Create a database server to serve as the backend database.
Use the following command to create a Redis pod:
```
kubectl run db-redis --image=redis --restart=Never
```
Challenge

Create a network policy that will deny communication by default.
1. Use the following YAML (this is where you can use kubernetes.io and search "network policies" and then search for the text "default"):
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```
2. Use the following command to apply the network policy:
```
kubectl apply -f default-deny.yaml
```
3. Verify that communication has been disabled by default:
```
kubectl run busybox --rm -it --image=busybox /bin/sh
# wget -O- ≤pod_ip_address>:80
```

Challenge

Apply the labels and create a communication over port 6379 to the database server.

Use the following commands to apply the labels:

kubectl get po
kubectl label po <pod_name> role=frontend
kubectl label po db-redis role=db
kubectl get po --show-labels

Use the following YAML to create a network policy for the communication between the two labeled pods (copy from kubernetes.io website):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: redis-netpolicy
spec:
  podSelector:
    matchLabels:
      role: db
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - port: 6379

Use the following command to create the network policy:
```
kubectl apply -f redis-netpolicy.yaml
```
Use the following command to view the network policies:
```
kubectl get netpol
```
Use the following command to describe the custom network policy:
```
kubectl describe netpol redis-netpolicy
```
Use the following command to show the labels on the pods:
```
kubectl get po --show-labels
```

Author

A Cloud Guru

The Cloud Content team comprises subject matter experts hyper focused on services offered by the leading cloud vendors (AWS, GCP, and Azure), as well as cloud-related technologies such as Linux and DevOps. The team is thrilled to share their knowledge to help you build modern tech solutions from the ground up, secure and optimize your environments, and so much more!

What's a lab?

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.