Hedronite · Cert Lesson · Cert-Prep / CNCF · Wed 2026-09-09

CKA Network Policies — least-permissive frontend to backend

Three YAMLs look similar. Only one matches the requirement without extras.

Lesson Class: Cert-Prep (CKA NetworkPolicy)

Bootcamp: Q13 Network Policy · Q8 CNI Network Policy

Read

Labels first.

Reject

Allow-all and extras.

Prove

Exec curl both ways.

Every selector must earn its place.

On the exam, three YAMLs look similar. Only one matches the requirement without extras.

§I — Frame

CKA NetworkPolicy items reward careful reading: namespaces, labels, ports, and which peer selectors appear. Bootcamp Q13 places frontend and backend Deployments in different namespaces and asks you to deploy the least permissive policy that still allows their interaction. Q8 reminds you that the CNI must support NetworkPolicy at all.

§II — Objective map

Need	Mechanism
CNI can enforce policy	Calico (or VPC CNI policy agent on EKS ops side); not plain Flannel alone
Deny by selection	NetworkPolicy with `policyTypes: [Ingress]` and empty `ingress`
Allow specific caller	`ingress.from` with `namespaceSelector` and/or `podSelector`
Allow CIDR	`ipBlock` (wider; reject if requirement is namespace-only)

§III — Q13 drill pattern

Read labels on frontend/backend pods (kubectl get pods -n frontend --show-labels).
Open the candidate policy files.
Reject "allow all ingress."
Reject extras (unexpected IP blocks or namespaces).
Apply the narrow match.
kubectl exec from frontend to backend Service DNS; confirm success.
Optionally exec from a third namespace; confirm failure.

§IV — Exam discriminators

Policy namespace must be the namespace of the pods being protected (usually backend).
podSelector: {} vs matchLabels changes blast radius inside the namespace.
Missing from peers on an ingress rule means allow from anywhere (wide).
DNS failure is not automatic proof the policy is wrong; verify CoreDNS separately.

§V — Q8 adjacency

If the cluster has no policy-capable CNI, installing policy YAML will not satisfy a task that requires enforcement. Know which install path you are allowed to use on the exam (manifest versions pinned in the prompt).

§VI — Study drill

Redraw frontend/backend namespaces. Write one policy from memory. Compare to Q13's third candidate. Timebox to 8 minutes.

§VII — Closing

Least permissive means every selector earns its place. Extra CIDRs fail the reading.