-In this video, we'll go over the practice test
on Network Policies.
How many Network Policies do you see in the environment?
We've deployed a few web applications,
services, and Network Policies.
Inspect the environment.
Let's take a look.
Seems to be an image.
We do not have the alias set.
First check out the pod.
We have four pods.
We have the external, internal, the MySQL, and payroll pod.
We have the external, we have the internal pod,
we have the payroll pod, and the DB pod, which is the MySQL pod.
Let's check out the services.
We have the db-service, the external-service, internal-service,
and Kubernetes service.
These are--
Sorry, the payroll service.
These are the services.
Each of them are on different pods.
We have 8080 for the payroll-service.
The external-service and internal-service are both on 8080.
Then you have the db-service, which is on 3306.
These are the port numbers.
The question is to identify the Network Policies in the environment.
We could do a k get networkpolicies.
You have the payroll-policy.
You could also do a k get netpol.
That's the short form for Network Policies.
We'll stick to this going forward.
There's one policy that's called as the payroll-policy,
so there's one policy in total.
What is the name of the network policy?
That is payroll-policy.
Okay.
Which part is the Network policy applied on?
If you look at this, you have a pod-selector
and it says name=payroll.
The name of the pod is payroll, and so the pod name is payroll.
The network policy named payroll-policy is applied on the pod,
which is called as payroll.
That's this pod.
If you look at the image,
we have now identified this is how it looks.
You have the external pod, internal pod,
DB pod, and then you have the payroll pod,
and then policy's applied on the payroll pod.
Now, as we learned from the lectures,
by default,
all pods allow traffic,
both ingress and egress
on all pods.
There are no restrictions, but as soon as you apply a network policy,
it's blocked.
Everything gets blocked.
Then you have to manually allow stuff.
Let's try and answer this question.
What type of traffic is the Network Policy configured to handle?
Let's look at the Network Policy in more detail.
Let's do k describe netpol payroll-policy.
We see the pod-selector,
which we know, and it's allowing ingress traffic
to port 8080 from the pod and it says, "Not affecting egress traffic."
There are no rules for egress traffic.
That means all egress traffic from this part to external
to outside world is not allowed.
The only thing that's allowed is ingress traffic.
What type of traffic is Network policy configured to handle,
is just ingress.
Okay. Now, what is the impact of the rule
configured on this Network policy?
Looking at this, we know that it allows ingress traffic
to port 8080.
This is to the port within the pod, from--
We have a pod-selector and the name is Internal.
This rule allows ingress traffic to pod 8080 on the payroll pod
from the internal pod.
This is basically what is allowed.
Traffic to and from payroll pod is blocked.
Not entirely true,
because we know that there is one route of traffic that is allowed.
Traffic from Internal to payroll pod is blocked.
Traffic to and from the internal pod
is blocked, and traffic from internal to payroll pod is allowed.
Traffic from internal to payroll pod is allowed.
That's the correct answer.
What is the impact of the rule configured on this network policy?
In other words, external pod can ping payroll pod.
That's not correct.
External pod can't do anything.
The internal pod can ping payroll pod and the internal pod cannot ping
the payroll pod, because we have only allowed the TCP rule.
That's not going to be allowed.
External pod can access port 8080.
That's not true, because they've not configured anything
for the external pod.
The internal pod can access port 8080 on payroll pod.
That's allowed.
That's the correct answer.
Access the UI of this application using the link given above the terminal.
If you look at this, we have the external portal
and the internal portal.
Let's open those up.
This is the internal-facing application, the blue background,
and this is the external-facing application.
Access the UI of these applications using the link.
We have just done that.
Perform a connectivity test using the user interface in these applications
to access the payroll service at port 8080.
We're going to try and see.
We said this network policy, but we're just going to see it for real.
From the external pod and the internal pod,
we're going to try and access this payroll pod on port 8080.
The service to access the payroll pod is the payroll service,
so we're going to copy this, and from the internal-facing application,
we're going to try to do a test and that is successful.
From the external-facing application, we're going to do a test,
and that's timed out.
This is working as expected.
The answer here is both internal and external applications
can access payroll service.
No, that's not correct.
Only internal applications can access the payroll service.
Perform a connectivity test using the user interface
on the internal application to access the external service at port 8080.
We want to see if--
We have identified that this is how it is.
Internal pod can access a payroll pod, and external pod cannot access
a payroll pod.
Let's see if the internal pod can access the external pod.
External service at port 8080.
This is the internal application.
I'm going to try to access the external application at port 8080,
and that is success.
That is allowed.
Let's select successful.
Finally, we have to create a network policy to allow traffic
from the internal application only to the payroll service and db-service.
This is the internal application, we want to block its access
to everything else except for the payroll service
and the database service.
This is what we want to achieve.
Basically, this is what we want to create.
Use the spec given below.
We have to create a network policy named internal policy,
and that is this.
After creating the policy we need to associate it with the internal pod.
That's the pod specification, like the pod selector
should be for the internal pod.
Then the policy is egress, so you're going to configure it
egress traffic.
We're going block everything except for the egress traffic
to both of these.
Then there should be two rules.
One is to the payroll pod and the other is to the DB pod which is the MySQL pod
as shown here.
Let's try and do that.
First let's go to the Kubernetes documentation pages
and look for network policies.
Let's get a template to start with,
so we're going to get until here.
Let's create a file called internal policy.yml.
The policy name
has to be
internal policy.
Then you have
the pod selector,
so we basically want to select this pod.
That's going to be,
and let's specify a name,
internal.
Let's pick
the egress rule so we only want egress rule.
Let's go back here,
let's first define what we want.
First, we need one rule
for this and another rule for this so basically we need two rules.
Let's add that here
and the first rule,
we need to specify the pod selector,
pod selector
and match labels.
We want to allow egress traffic to the pod payroll
so we're going to give it a name, payroll.
We also want to specify ports.
We want to allow protocol TCP to port so to payroll it's 8080.
That's the first rule.
The same way we're going to have for the second rule,
we need to specify
to which pod as well to which port.
Let's just check it here, it should be each one
will have two end ports so it's actually ports then I fix that.
Within this, we're going to have pod selector,
then we're going to have match labels and then we have MySQL.
That's the second pod, then we're going to have ports,
then we specify the protocol which happens to be TCP
and of port for MySQL is 3306 as you can see here.
This particular policy, we're going to remove egress from here.
What it does it creates an internal policy for the internal pod using this label.
Everything has a label with a name on it and then we're allowing egress
to the payroll pod on port 8080
and then on the MySQL pod on port 3306.
Let's create that policy.
Let's do a describe
internal policy
and we verify
and the pod selector
and the egress traffic configuration.
We have 8080 to payroll on 3306 to MySQL is configured.
You'll have egress policy is configured.
Check it out.
That's about it and that's the end of this lab.