Room 20

NETWORK POLICIES

The Firewall Maze

By default, all pods can talk to all pods. Network Policies change that.
A pod is leaking data to an unauthorized receiver. Lock it down!

📜 Mission Briefing

Apply setup.yaml to deploy a web pod and db pod in namespace secure-zone.
Verify the web pod CAN reach the db pod initially.
Apply network-policy.yaml - blocks all ingress to the db pod except from pods with label role=web.
Verify the web pod can STILL reach db, but a random test pod CANNOT.
The db pod has the password in its environment variable ESCAPE_KEY.
The password is netpol99.

Key Commands

Command	Purpose
`kubectl get netpol -n NS`	List Network Policies
`kubectl describe netpol NAME -n NS`	Policy details
`kubectl run test --image=busybox --rm -it -- wget -T2 -qO- http://IP`	Test connectivity

How Network Policies Work

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-policy
  namespace: secure-zone
spec:
  podSelector:                    # Which pods this policy applies to
    matchLabels:
      role: database
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:            # Allow from pods with label role=web
            matchLabels:
              role: web
        - namespaceSelector:      # Allow from namespace with label env=prod
            matchLabels:
              env: prod
      ports:
        - protocol: TCP
          port: 5432
  egress:
    - to:
        - podSelector:
            matchLabels:
              role: dns
      ports:
        - protocol: UDP
          port: 53

# Network Policies are ADDITIVE - multiple policies combine
# If NO policy selects a pod → all traffic allowed
# If ANY policy selects a pod → only explicitly allowed traffic goes through

# Common patterns:

# Deny all ingress to a namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}    # Empty = all pods
  policyTypes:
    - Ingress        # No ingress rules = deny all

# Allow only specific pods
kubectl get netpol -n secure-zone
kubectl describe netpol db-policy -n secure-zone

# Test connectivity
kubectl exec web-pod -n secure-zone -- wget -T2 -qO- http://db-svc:5432
kubectl run rogue --image=busybox --rm -it -n secure-zone -- wget -T2 -qO- http://db-svc:5432

Hints

Hint 1

Check connectivity before and after applying the policy:

# Before policy: both should work
kubectl exec web-pod -n secure-zone -- wget -T2 -qO- http://db-svc
kubectl run test --image=busybox --rm -it -n secure-zone -- wget -T2 -qO- http://db-svc

Hint 2

After applying the policy, only the web pod should connect:

kubectl apply -f network-policy.yaml
kubectl exec web-pod -n secure-zone -- wget -T2 -qO- http://db-svc  # Works
kubectl run test --image=busybox --rm -it -n secure-zone -- wget -T2 -qO- http://db-svc  # Blocked

Hint 3

The password is netpol99.

🔓 Unlock Room 21

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_21/README             \
        -out ../room_21/README.txt        \
        -pass pass:PASSWORD
cat ../room_21/README.txt