The backend accepts traffic from anywhere
A namespace has no default-deny, and the backend's NetworkPolicy allows ingress from every pod. Lock it to default-deny plus a targeted frontend to backend allow.
Scenario
In this namespace there's no default-deny, and the backend's only NetworkPolicy allows ingress from every pod. Anything in the cluster that can reach the pod network can hit the backend.
You want a default-deny baseline, then a single targeted allow: the frontend may reach the backend, nothing else.
Your job
In networkpolicy.yaml:
- Add a default-deny ingress policy that selects all pods (
podSelector: {},policyTypes: [Ingress], noingressrules). - Add a policy that selects the backend (
app: backend) and allows ingress from the frontend (app: frontend). - Make sure no policy leaves the backend open to all pods.
What "done" looks like
A default-deny ingress policy exists, the backend allows ingress from the frontend, and nothing allows the backend to accept traffic from any pod.
Graded on the manifest's shape, not a live cluster.
Teaches: Kubernetes is allow-by-default on the pod network: segmentation is a default-deny policy plus explicit, label-scoped allows.
What gets checked
Your solution is verified against each of these:
- A default-deny ingress policy selects all pods
- The backend allows ingress from the frontend pods
- No policy lets the backend accept traffic from any pod
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.