Lab & Completion

What You Will Produce

On your own kind cluster, proof that the platform’s policies hold: in develop a probe without the frontend’s label cannot reach the backend and a probe with it can, and nothing in develop reaches production - not the backend, not the database, not even a pod that claims to be the backend. Then, in the namespace lab, a service you isolate step by step: open, default deny, one connection allowed on both ends and one port. You see that deleting the deny alone opens nothing, and that one “allow everything” policy undoes every rule. The lab ends with lab empty again; the policies of develop are never touched.

Before You Start

The baseline from Chapter 00 must be clean:

flux --context kind-sre-control-plane get kustomizations -A          # every row READY=True and SUSPENDED=False
kubectl --context kind-sre-control-plane get pods -A --no-headers | grep -vE 'Running|Completed'   # prints nothing
make smoke-test                     # 9/9

This chapter also needs two things from the platform repository - scripts/np-probe.sh and labs/network-policies/ - and the tool jq.

  • If either path is missing, your fork must first catch up with the course repository: on GitHub, open your fork and click Sync fork → Update branch. Then git switch main && git pull - it fetches from your clone’s remote (your fork) and merges the changes into your local main; it does not sync your fork with the course repository, which is why the Sync fork step comes first.
  • If jq is missing, install it as Chapter 00 shows: make check-tools names every missing tool and how to install it.

The Lab in Three Parts

  • A. Verify - the policies of develop; only the frontend reaches the backend; nothing in develop reaches production.
  • B. Break & Fix - in lab: open, default deny, DNS written down, one connection on both ends, removing the deny opens nothing, the “allow everything” shortcut.
  • C. Rollback & Cleanup - everything the lab created deleted, lab empty, the baseline proven.

Open the lab →

Done When

  • in develop, a probe without a label printed TCP blocked to the backend and one with app=frontend printed TCP open (A3)
  • from develop, the production backend and the production database printed TCP blocked - even with app=frontend and app=backend (A4)
  • in lab, the probe printed TCP open before the default deny and DNS FAILED after it (B1-B2), then DNS ok (...), TCP blocked with the DNS policy (B3)
  • after 30-allow-client-to-api.yaml, only the probe with app=lab-client printed TCP open (B4)
  • after deleting default-deny-all alone, the probe still printed TCP blocked (B5)
  • with the shortcut the probe printed TCP open, after deleting it TCP blocked (B6)
  • at the end kubectl --context kind-sre-control-plane -n lab get networkpolicy,service,pod prints No resources found and the baseline is clean (C1-C2)

Knowledge Check

Before finishing this chapter, complete the Quiz.