Skip to main content

CKA Practice Exam: Part 3

Hands-On Lab

 

Photo of Chad Crowell

Chad Crowell

DevOps Training Architect II in Content

Length

01:30:00

Difficulty

Intermediate

Network policies are important for specifying which pods can talk to which. You can apply network policies to certain pods using their label selectors. In this part of the practice exam, you will be responsible for creating a default-deny policy, as well as explicitly stating communication over a certain port. This will simulate a possible exam question and have you show your expertise with pod communication and security.

What are Hands-On Labs?

Hands-On Labs are scenario-based learning environments where learners can practice without consequences. Don't compromise a system or waste money on expensive downloads. Practice real-world skills without the real-world risk, no assembly required.

CKA Practice Exam: Part 3

In this part of the practice exam, you will be responsible for creating a default-deny policy, as well as explicitly stating communication over a certain port. This will simulate a possible exam question and have you show your expertise with pod communication and security.

Log in to the Kube Master server using the credentials on the lab page (either in your local terminal, using the Instant Terminal feature, or using the public IP), and work through the objectives listed.

Create a deployment and a service to expose your web front end.

  1. Create the YAML for your deployment:

    kubectl create deployment webfront-deploy  --image=nginx:1.7.8  --dry-run -o yaml > webfront-deploy.yaml
  2. Add the following to your YAML in order to expose the container port:

    - containerPort:80
  3. Create your deployment:

    kubectl apply -f webfront-deploy.yaml
  4. Scale up your deployment:

    kubectl scale deployment/webfront-deploy --replicas=2
  5. Create the YAML for a service:

    kubectl expose deployment/webfront --port=80 --target-port=80 --type=NodePort --dry-run -o yaml > webfront-service.yaml
  6. Add the following to the YAML for the service:

    name: webfront-service
    nodePort: 30080
  7. Create the service:

    kubectl apply -f webfront-service.yaml
  8. Verify that you can communicate with your pod directly:

    kubectl run busybox --rm -it --image=busybox /bin/sh
    # wget -O- <pod_ip_address>:80
    # wget --spider --timeout=1 webfront-service
  9. Exit out of the shell:

    exit

Create a database server to serve as the backend database.

  1. Create a Redis pod:

    kubectl run db-redis --image=redis --restart=Never

Create a network policy that will deny communication by default.

  1. Use the following YAML (this is where you can use kubernetes.io, search "network policies", and then search for the text "default"):

    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: default-deny
    spec:
      podSelector: {}
      policyTypes:
      - Ingress
  2. Apply the network policy:

    kubectl apply default-deny.yaml
  3. Verify that communication has been disabled by default:

    kubectl run busybox --rm -it --image=busybox /bin/sh
    # wget -O- <pod_ip_address>:80
  4. Exit out of the shell:

    exit

Apply the labels and create a communication over port 6379 to the database server.

  1. Get pods:

    kubectl get po
  2. Apply label to the Redis pod:

    kubectl label po db-redis role=db
  3. Apply labels to both webfront pods (running this command twice — once for each pod):

    kubectl label po <pod_name> role=frontend
  4. View the labels:

    kubectl get po --show-labels
  5. Use the following YAML to create a network policy for the communication between the two labeled pods (copy from kubernetes.io website):

    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: redis-netpolicy
    spec:
      podSelector:
        matchLabels:
          role: db
      ingress:
      - from:
        - podSelector:
            matchLabels:
              role: frontend
        ports:
        - port: 6379
  6. Create the network policy:

    kubectl apply -f redis-netpolicy.yaml
  7. View the network policies:

    kubectl get netpol
  8. Use the following command to describe the custom network policy:

    kubectl describe netpol redis-netpolicy
  9. Use the following command to show the labels on the pods:

    kubectl get po --show-labels

Conclusion

Congratulations on completing this portion of the practice exam!