Real CKA Question 15 of 17 — Least-Permissive NetworkPolicy Between Namespaces
🧠 Introduction
Real CKA Question 15 of 17 — Least-Permissive NetworkPolicy Between Namespaces
🧠 Introduction
Most people treat Kubernetes networking like it’s wide open — and that’s exactly why they fail this question.
By default, everything talks to everything in Kubernetes. If you don’t explicitly restrict it, your cluster is basically a free-for-all. That’s not security — that’s negligence.
This task forces you to prove you actually understand NetworkPolicies, not just YAML copying.
You can also consider enrolling in the full course where I solve all 17 questions in detail:
*https://www.udemy.com/course/cka-2026-latest-exam-17-real-exam-questions-with-solutions/*
Previous Questions in the CKA Series
👉 Question 14 of 17 — Create a Horizontal Pod Autoscaler (HPA) Read the full article
[embed]Real CKA Exam Question 14 of 17 Migrating from Ingress to Gateway API Introductionmedium.com
❓ The Question
You are given:
- A frontend deployment in the
frontendnamespace - A backend deployment in the
backendnamespace
👉 Task:
Create a NetworkPolicy that:
- Allows communication ONLY from frontend → backend
- Blocks everything else
- Follows the least permissive principle
🛠️ Solution
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-backend
namespace: backend
spec:
podSelector:
matchLabels:
app: backend
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend
podSelector:
matchLabels:
app: frontend🔍 Explanation
- metadata.namespace: backend The policy is applied within the backend namespace.
- podSelector: app=backend Targets pods labeled as backend.
- policyTypes: Ingress Defines rules for incoming traffic.
- ingress.from Allows traffic only from:
- Pods labeled
app=frontend - Within namespaces labeled
name=frontend
🧪 Testing the NetworkPolicy
🧪 Testing the NetworkPolicy
1. Create Test Pod in Frontend Namespace
kubectl run test-frontend --image=busybox:stable -n frontend --restart=Never -- sleep 3600Get the pod:
kubectl get pods -n frontendExec into the pod:
kubectl exec -it test-frontend -n frontend -- shRun request:
wget -qO- http://192.168.241.190- If backend is serving HTTP (e.g., nginx):
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...
</html>- Or any response your backend app returns (JSON, HTML, plain text)
👉 Key point: You get actual content, because traffic is allowed.
2. Create Test Pod in Default Namespace
kubectl run test-default --image=busybox:stable --restart=Never -- sleep 3600Get the pod:
kubectl get podsExec into the pod:
kubectl exec -it test-default -- shRun request:
wget -qO- http://192.168.241.190👉 Output:
- Most common:
wget: download timed outOR
Connecting to <backend-ip>:80... failed: Connection timed out.👉 Key point:
- No response
- Request never reaches backend
- Traffic is silently dropped
🏁 Conclusion
This setup ensures that backend pods accept traffic only from frontend pods in the specified namespace, while all other incoming connections are restricted using a NetworkPolicy.
메타데이터
- post_id
- b2ff9f49a147
- slug
- real-cka-question-15-of-17-least-permissive-networkpolicy-between-namespaces-b2ff9f49a147
- url
- https://medium.com/@tradingcontentdrive/real-cka-question-15-of-17-least-permissive-networkpolicy-between-namespaces-b2ff9f49a147
- canonical_url
- https://medium.com/@tradingcontentdrive/real-cka-question-15-of-17-least-permissive-networkpolicy-between-namespaces-b2ff9f49a147
- author_url
- https://medium.com/@tradingcontentdrive
- status
- ok
- fetched_at
- 2026-06-22 05:41:33
