Discuss Linux Foundation CKA Exam Topic 3 Question 63

Score: 7%

Task

Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in namespace echo.

Further ensure that the new NetworkPolicy:

* does not allow access to Pods, which don't listen on port 9000

* does not allow access from Pods, which are not in namespace my-app

AExplanation:
Solution:
#network.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-port-from-namespace
namespace: internal
spec:
podSelector:
matchLabels: {
}
policyTypes:
- Ingress
ingress:
- from:
- podSelector: {
}
ports:
- protocol: TCP
port: 8080
#spec.podSelector namespace pod
kubectl create -f network.yaml

Suggested Answer: A

Get Premium CKA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

36 comments · newest first

Theron 11 months ago

This is a solid start, but double-check the ingress rules!

Terry 11 months ago

Just a heads up, make sure the podSelector is properly defined.

Angelo 12 months ago

Wait, why is the namespace set to "internal"? Shouldn't it be "echo"?

Bambi 12 months ago

Totally agree, that’s a crucial detail!

Jestine 1 year ago

Looks like the port should be 9000, not 8080.

Tuyet 1 year ago

I remember that we have to define both the ingress rules and the podSelector, but I can't recall the exact syntax for matching the namespace.

Rickie 1 year ago

I'm a bit confused about the port number; I thought we were supposed to allow access to port 9000, but the example shows port 8080.

Meaghan 1 year ago

I practiced a similar question where we had to restrict access based on labels, so I think we need to use podSelector correctly here.

Gary 1 year ago

I think I remember that we need to specify the correct namespace for the NetworkPolicy, but I'm not sure if "internal" is the right one.

Margo 1 year ago

This seems straightforward enough. I'll just need to make sure I get the YAML syntax correct for the NetworkPolicy.

Elina 1 year ago

Okay, I think I've got a plan. I'll create the NetworkPolicy in the echo namespace and use the podSelector and from fields to target the right Pods.

Rossana 1 year ago

Hmm, I'm a bit confused about the namespace requirements. I'll need to double-check the details to make sure I understand which namespaces are involved.

Tennie 1 year ago

This looks like a tricky one. I'll need to carefully read through the requirements and think through the steps to create the NetworkPolicy.

Adrianna 1 year ago

I'm feeling pretty confident about this one. I've worked with NetworkPolicies before, so I should be able to knock this out quickly.

Johnetta 1 year ago

Hmm, this seems pretty simple, but I want to double-check a few things. Do I need to do anything special with the ifdown/ifup commands, or is that just to make sure the changes take effect? And is there anything else I need to do to enable IP forwarding on the lab server, or is that already taken care of?

Vallie 2 years ago

I'm a bit concerned about the 'does not allow access from Pods, which are not in namespace my-app' part. Shouldn't we also specify the 'from' selector in the ingress rule?

Lettie 2 years ago

↳ replying to Vallie

Let's update the NetworkPolicy yaml file to include the 'from' selector for the ingress rule. That way, we can restrict access to only Pods in the my-app namespace.

Merlyn 2 years ago

↳ replying to Vallie

That makes sense. We need to ensure that only Pods from the my-app namespace can access port 9000 in the echo namespace.

Tegan 2 years ago

↳ replying to Vallie

Yes, you're right. We should add the 'from' selector in the ingress rule to specify Pods in the my-app namespace.

Ariel 2 years ago

↳ replying to Vallie

Agreed, let's update the ingress rule to include the 'from' selector for Pods in namespace my-app.

Frank 2 years ago

↳ replying to Vallie

That's a good point. We need to make sure only Pods from namespace my-app can access port 9000.

Dick 2 years ago

↳ replying to Vallie

Yes, you're right. We should add the 'from' selector in the ingress rule to specify Pods in namespace my-app.

Ryan 2 years ago

I feel confident about this question, I have practiced similar tasks before.

Sommer 2 years ago

Haha, the question says 'ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000', but the solution is using port 8080. Someone needs to pay more attention to the details!

Loren 2 years ago

↳ replying to Sommer

Yeah, attention to detail is key in these scenarios. Port numbers matter!

Pamella 2 years ago

↳ replying to Sommer

Oops, looks like they made a mistake in the solution. It should be port 9000, not 8080.

Elinore 2 years ago

Wait, aren't we supposed to allow access to port 9000, not 8080? I think I see a typo in the solution.

Jesusa 2 years ago

↳ replying to Elinore

Let's update the network.yaml file to specify port 9000 instead of 8080. That should fix the issue.

Talia 2 years ago

↳ replying to Elinore

You're right, there seems to be a mistake in the solution. We should allow access to port 9000, not 8080.

Elli 2 years ago

I think the key is to carefully follow the instructions and use the provided solution as a guide.

Anissa 2 years ago

I agree, creating a new NetworkPolicy can be challenging.

Yun 2 years ago

This question seems tricky.

Christa 2 years ago

Hmm, the question seems straightforward enough, but I'm a bit confused about the namespace part. Shouldn't it be 'echo' instead of 'internal'?

Hannah 2 years ago

↳ replying to Christa

Make sure to update the namespace in the NetworkPolicy to 'echo' for it to work correctly.

Billy 2 years ago

↳ replying to Christa

Yes, the namespace in the NetworkPolicy should match the existing namespace 'echo'.

Curt 2 years ago

↳ replying to Christa

You're right, the namespace should be 'echo' instead of 'internal'.

Linux Foundation CKA Exam - Topic 3 Question 63 Discussion