You have a Deployment that runs a containerized web application. The web application depends on a specific database service running on a different node in the cluster. The web application should only be able to connect to the database service on port 5432 and not any other services running on the database node. How can you define a NetworkPolicy to achieve this?

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Network Policy Definition:

2. Explanation: - 'apiVersion: networking.k8s.io/v1 Specifies the API version for NetworkPolicy resources. - 'kind: NetworkPolicy': Specifies that this is a NetworkPolicy resource. - 'metadata.name: allow-database-access': Sets the name of the NetworkPolicy. - 'metadata.namespace: Specifies the namespace where the NetworkPolicy is applied. Replace with the actual namespace where your web application Deployment is running. - 'spec.podSelector.matchLabels: app: web-app': This selector targets Pods labeled with 'app: web-app', ensuring the NetworkPolicy applies to the web application Pods. - 'spec.ingress.from.podSelector.matchLabels: app: database': This allows incoming traffic only from Pods labeled with 'app: database'. - 'spec.ingress.ports.port: 5432': This allows communication only on port 5432. - 'spec.ingress.ports.protocol: TCP': Specifies the protocol (TCP) for the allowed port. 3. How it works: - This NetworkPolicy allows the web application Pods to connect only to the database service Pods on port 5432. It denies all other traffic from the database node, including other services that might be running on that node. 4. Implementation: - Apply the YAML using 'kubectl apply -f allow-database-access.yaml' 5. Verification: After applying the NetworkPolicy, test the connectivity from the web application Pods to the database service on port 5432 and to other services on the database node. You should observe that the NetworkPolicy effectively enforces the restrictions, allowing access only to the specified database port.

Comment: *

Name: *

Email: *

Verification: *

Score: 4%

Task
Schedule a pod as follows:
* Name: nginx-kusc00401
* Image: nginx
* Node selector: disk=ssd

Comment: *

Name: *

Email: *

Verification: *

Configure the kubelet systemd- managed service, on the node labelled with name=wk8s-node-1, to launch a pod containing a single container of Image httpd named webtool automatically. Any spec files required should be placed in the /etc/kubernetes/manifests directory on the node.
You can ssh to the appropriate node using:
[student@node-1] $ ssh wk8s-node-1
You can assume elevated privileges on the node with the following command:
[student@wk8s-node-1] $ | sudo -i

Correct Answer:

See the solution below.
Explanation
solution

Comment: *

Name: *

Email: *

Verification: *

You have a deployment named 'redis-deployment' running a Redis server with 3 replicas. You need to configure a service with the 'NodePort' type to expose Redis on all nodes in the cluster, but restrict access only from specific pods within a namespace.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a NetworkPolicy:
- Define a NetworkPolicy resource that allows traffic from specific pods in a namespace to the Redis service.

2. Create the NodePort service: - Create a NodePort service for the Redis deployment, allowing access to the Redis server through all nodes in the cluster.

3. Apply the resources: - Apply the NetworkPolicy and service using 'kubectl apply -f networkpolicy.yaml' and 'kubectl apply -f redis- service.yamP. 4. Verify: - Check the status of the NetworkPolicy and service: - 'kubectl get networkpolicies allow-specific-pods-to-redis -n - 'kubectl get services redis-service -n 5. Test: - From a pod labeled with 'app: allowed-app', try to connect to the Redis service using the NodePort on the node. - From a pod that doesn't have the 'allowed-app' label, attempt to connect to the Redis service using the NodePort. You should not be able to connect. Note: Replace with the actual namespace where your Redis deployment and the pods allowed to access it are located.

Comment: *

Name: *

Email: *

Verification: *

List all service account and create a service account called "admin"

• A.kubectl get sa
  kubectl get sa --all-namespaces
  kubectl create sa admin
  //Verify
  kubectl get sa admin -o yaml
• B.kubectl get sa
  kubectl get sa --all-namespaces
  //Verify
  kubectl get sa admin -o yaml

Comment: *

Name: *

Email: *

Verification: *