Turn a flat cluster network into default-deny

applied · 75 min · Objective 4.3

Task

Demonstrate that pods can reach everything by default, then close it down with network policy -- including egress, which is the half people skip and the half that blocks credential theft and exfiltration.

Steps

  1. Deploy three workloads -- web, app and data -- in one namespace. From the web pod, connect to the data pod directly and record the success in lab/netpol.md. This is the default that surprises people.
  2. Apply a deny-all ingress policy for the namespace. Retry the same connection and confirm it now FAILS. If it still succeeds, your plugin is not enforcing policy -- record that and switch plugins before continuing, because everything after this depends on it.
  3. Add allow rules so web reaches app and app reaches data, and confirm the intended paths work while web-to-data still fails.
  4. Apply deny-all EGRESS, then re-add DNS. Record what broke when egress was closed and what fixing DNS restored.
  5. From a pod, attempt to reach the host metadata address before and after the egress policy, and record both results.

Verify

grep -Eci 'enforc' lab/netpol.md
grep -Ec 'fail|refused|timeout|denied' lab/netpol.md
grep -Eci 'dns' lab/netpol.md
grep -Eci 'metadata' lab/netpol.md

All four non-zero, with the enforcement verification explicitly recorded. A network policy that is accepted and ignored is the most dangerous possible outcome, because the control appears to exist.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.