WEBVTT

00:00.450 --> 00:03.149
-In this video,
we'll go over the practice test

00:03.150 --> 00:04.150
on Network Policies.

00:05.430 --> 00:08.369
How many Network Policies
do you see in the environment?

00:08.370 --> 00:10.177
We've deployed a few web applications,

00:10.747 --> 00:12.146
services, and Network Policies.

00:12.157 --> 00:13.157
Inspect the environment.

00:14.277 --> 00:15.277
Let's take a look.

00:16.080 --> 00:18.851
Seems to be an image.

00:21.916 --> 00:23.786
We do not have the alias set.

00:29.828 --> 00:31.916
First check out the pod.

00:31.917 --> 00:35.380
We have four pods.

00:35.381 --> 00:39.270
We have the external, internal,
the MySQL, and payroll pod.

00:39.801 --> 00:42.204
We have the external,
we have the internal pod,

00:42.544 --> 00:47.108
we have the payroll pod,
and the DB pod, which is the MySQL pod.

00:51.450 --> 00:52.920
Let's check out the services.

00:55.212 --> 00:57.539
We have the db-service,
the external-service, internal-service,

00:57.540 --> 00:58.590
and Kubernetes service.

01:00.300 --> 01:01.300
These are--

01:01.961 --> 01:03.042
Sorry, the payroll service.

01:03.341 --> 01:04.491
These are the services.

01:05.160 --> 01:07.755
Each of them are on different pods.

01:07.835 --> 01:11.096
We have 8080 for the payroll-service.

01:11.790 --> 01:14.111
The external-service
and internal-service are both on 8080.

01:15.510 --> 01:18.589
Then you have the db-service,
which is on 3306.

01:19.931 --> 01:21.450
These are the port numbers.

01:22.090 --> 01:26.964
The question is to identify
the Network Policies in the environment.

01:26.965 --> 01:30.975
We could do a k get networkpolicies.

01:37.042 --> 01:38.369
You have the payroll-policy.

01:38.370 --> 01:41.760
You could also do a k get netpol.

01:41.879 --> 01:45.474
That's the short form
for Network Policies.

01:45.508 --> 01:46.868
We'll stick to this going forward.

01:48.506 --> 01:51.639
There's one policy
that's called as the payroll-policy,

01:51.694 --> 01:53.334
so there's one policy in total.

01:55.800 --> 01:57.540
What is the name of the network policy?

01:58.560 --> 01:59.960
That is payroll-policy.

02:03.781 --> 02:04.781
Okay.

02:05.070 --> 02:07.883
Which part is
the Network policy applied on?

02:08.880 --> 02:11.069
If you look at this,
you have a pod-selector

02:11.070 --> 02:12.700
and it says name=payroll.

02:13.110 --> 02:17.433
The name of the pod is payroll,
and so the pod name is payroll.

02:18.000 --> 02:22.560
The network policy named payroll-policy
is applied on the pod,

02:22.830 --> 02:24.929
which is called as payroll.

02:24.930 --> 02:25.930
That's this pod.

02:28.266 --> 02:29.266
If you look at the image,

02:29.730 --> 02:33.930
we have now identified
this is how it looks.

02:34.767 --> 02:36.256
You have the external pod, internal pod,

02:36.257 --> 02:38.817
DB pod, and then you have the payroll pod,

02:38.847 --> 02:41.220
and then policy's applied
on the payroll pod.

02:42.090 --> 02:45.318
Now, as we learned from the lectures,

02:46.548 --> 02:47.564
by default,

02:48.635 --> 02:50.885
all pods allow traffic,

02:51.177 --> 02:52.634
both ingress and egress

02:52.914 --> 02:53.914
on all pods.

02:53.937 --> 02:56.688
There are no restrictions,
but as soon as you apply a network policy,

02:57.075 --> 02:58.230
it's blocked.

02:58.316 --> 02:59.340
Everything gets blocked.

02:59.700 --> 03:02.480
Then you have to manually allow stuff.

03:03.660 --> 03:06.561
Let's try and answer this question.

03:07.050 --> 03:09.930
What type of traffic is
the Network Policy configured to handle?

03:10.473 --> 03:13.424
Let's look at the Network Policy
in more detail.

03:13.472 --> 03:25.389
Let's do k describe netpol payroll-policy.

03:30.102 --> 03:31.321
We see the pod-selector,

03:31.371 --> 03:34.805
which we know,
and it's allowing ingress traffic

03:35.188 --> 03:40.019
to port 8080 from the pod and it says,
"Not affecting egress traffic."

03:40.020 --> 03:42.089
There are no rules for egress traffic.

03:42.090 --> 03:45.539
That means all egress traffic
from this part to external

03:45.540 --> 03:48.750
to outside world is not allowed.

03:49.767 --> 03:52.217
The only thing that's allowed
is ingress traffic.

03:53.100 --> 03:55.740
What type of traffic
is Network policy configured to handle,

03:56.130 --> 03:57.180
is just ingress.

03:59.910 --> 04:02.062
Okay. Now,
what is the impact of the rule

04:02.532 --> 04:03.892
configured on this Network policy?

04:06.000 --> 04:10.140
Looking at this,
we know that it allows ingress traffic

04:10.320 --> 04:11.340
to port 8080.

04:11.680 --> 04:17.460
This is to the port within the pod,
from--

04:18.510 --> 04:21.010
We have a pod-selector
and the name is Internal.

04:22.110 --> 04:26.520
This rule allows ingress traffic
to pod 8080 on the payroll pod

04:28.020 --> 04:29.520
from the internal pod.

04:29.580 --> 04:32.370
This is basically what is allowed.

04:33.150 --> 04:35.280
Traffic to and from payroll pod
is blocked.

04:36.660 --> 04:37.660
Not entirely true,

04:38.976 --> 04:43.890
because we know that there
is one route of traffic that is allowed.

04:44.340 --> 04:48.450
Traffic from Internal
to payroll pod is blocked.

04:50.400 --> 04:52.847
Traffic to and from the internal pod

04:54.212 --> 04:58.597
is blocked, and traffic from internal
to payroll pod is allowed.

04:59.010 --> 05:04.350
Traffic from internal
to payroll pod is allowed.

05:08.400 --> 05:09.440
That's the correct answer.

05:15.690 --> 05:19.049
What is the impact of the rule configured
on this network policy?

05:19.050 --> 05:25.193
In other words,
external pod can ping payroll pod.

05:25.213 --> 05:26.400
That's not correct.

05:26.983 --> 05:28.590
External pod can't do anything.

05:29.430 --> 05:34.229
The internal pod can ping payroll pod
and the internal pod cannot ping

05:34.230 --> 05:40.001
the payroll pod,
because we have only allowed the TCP rule.

05:40.631 --> 05:41.871
That's not going to be allowed.

05:42.041 --> 05:43.971
External pod can access port 8080.

05:44.021 --> 05:46.469
That's not true,
because they've not configured anything

05:46.470 --> 05:47.470
for the external pod.

05:47.790 --> 05:53.428
The internal pod
can access port 8080 on payroll pod.

05:53.514 --> 05:54.394
That's allowed.

05:54.451 --> 05:56.640
That's the correct answer.

06:01.351 --> 06:04.819
Access the UI of this application using
the link given above the terminal.

06:07.689 --> 06:12.509
If you look at this,
we have the external portal

06:12.510 --> 06:13.510
and the internal portal.

06:14.405 --> 06:15.970
Let's open those up.

06:16.941 --> 06:21.978
This is the internal-facing application,
the blue background,

06:22.028 --> 06:24.527
and this is
the external-facing application.

06:28.016 --> 06:31.014
Access the UI
of these applications using the link.

06:31.724 --> 06:33.214
We have just done that.

06:34.690 --> 06:37.680
Perform a connectivity test using
the user interface in these applications

06:37.710 --> 06:41.101
to access the payroll service
at port 8080.

06:41.181 --> 06:42.750
We're going to try and see.

06:43.560 --> 06:46.530
We said this network policy,
but we're just going to see it for real.

06:46.590 --> 06:48.750
From the external pod
and the internal pod,

06:49.171 --> 06:55.073
we're going to try and access
this payroll pod on port 8080.

06:55.363 --> 06:59.040
The service to access
the payroll pod is the payroll service,

06:59.670 --> 07:03.120
so we're going to copy this,
and from the internal-facing application,

07:04.080 --> 07:07.470
we're going to try to do
a test and that is successful.

07:08.100 --> 07:11.940
From the external-facing application,
we're going to do a test,

07:14.940 --> 07:15.940
and that's timed out.

07:16.710 --> 07:18.630
This is working as expected.

07:19.770 --> 07:21.959
The answer here is both internal
and external applications

07:21.960 --> 07:23.669
can access payroll service.

07:23.670 --> 07:25.050
No, that's not correct.

07:25.740 --> 07:28.150
Only internal applications
can access the payroll service.

07:31.560 --> 07:33.509
Perform a connectivity test using
the user interface

07:33.510 --> 07:37.951
on the internal application to access
the external service at port 8080.

07:37.996 --> 07:39.226
We want to see if--

07:39.987 --> 07:42.600
We have identified that this is how it is.

07:43.517 --> 07:46.364
Internal pod can access a payroll pod,
and external pod cannot access

07:46.434 --> 07:47.084
a payroll pod.

07:47.164 --> 07:51.004
Let's see if the internal pod
can access the external pod.

07:52.524 --> 07:54.534
External service at port 8080.

07:55.354 --> 07:57.094
This is the internal application.

07:57.144 --> 08:00.484
I'm going to try to access
the external application at port 8080,

08:01.320 --> 08:02.320
and that is success.

08:02.820 --> 08:03.820
That is allowed.

08:04.677 --> 08:05.691
Let's select successful.

08:11.850 --> 08:15.479
Finally, we have to create
a network policy to allow traffic

08:15.480 --> 08:18.770
from the internal application only
to the payroll service and db-service.

08:19.525 --> 08:22.199
This is the internal application,
we want to block its access

08:22.200 --> 08:24.269
to everything else except
for the payroll service

08:24.270 --> 08:26.060
and the database service.

08:26.400 --> 08:28.019
This is what we want to achieve.

08:28.020 --> 08:29.700
Basically, this is what we want to create.

08:31.380 --> 08:32.670
Use the spec given below.

08:33.480 --> 08:36.240
We have to create
a network policy named internal policy,

08:37.110 --> 08:38.110
and that is this.

08:44.894 --> 08:48.344
After creating the policy we need
to associate it with the internal pod.

08:49.154 --> 08:52.394
That's the pod specification,
like the pod selector

08:52.444 --> 08:53.834
should be for the internal pod.

08:54.690 --> 08:57.383
Then the policy is egress,
so you're going to configure it

08:57.413 --> 08:58.713
egress traffic.

08:59.233 --> 09:01.452
We're going block everything
except for the egress traffic

09:01.453 --> 09:02.470
to both of these.

09:03.070 --> 09:05.429
Then there should be two rules.

09:05.430 --> 09:12.479
One is to the payroll pod and the other
is to the DB pod which is the MySQL pod

09:12.480 --> 09:13.480
as shown here.

09:13.770 --> 09:14.770
Let's try and do that.

09:15.690 --> 09:19.860
First let's go
to the Kubernetes documentation pages

09:22.621 --> 09:23.921
and look for network policies.

09:27.510 --> 09:30.451
Let's get a template to start with,

09:31.524 --> 09:36.595
so we're going to get until here.

09:41.763 --> 09:47.353
Let's create a file
called internal policy.yml.

09:51.458 --> 09:53.775
The policy name

09:57.227 --> 09:59.625
has to be

10:02.967 --> 10:06.436
internal policy.

10:07.942 --> 10:08.955
Then you have

10:10.242 --> 10:11.252
the pod selector,

10:11.332 --> 10:13.142
so we basically want to select this pod.

10:15.645 --> 10:17.052
That's going to be,

10:19.996 --> 10:22.482
and let's specify a name,

10:24.553 --> 10:25.553
internal.

10:31.005 --> 10:32.005
Let's pick

10:33.544 --> 10:38.295
the egress rule
so we only want egress rule.

10:42.603 --> 10:43.603
Let's go back here,

10:47.093 --> 10:49.053
let's first define what we want.

10:49.366 --> 10:51.563
First, we need one rule

10:52.893 --> 10:55.922
for this and another rule for this
so basically we need two rules.

10:56.814 --> 10:58.094
Let's add that here

11:00.162 --> 11:03.061
and the first rule,

11:06.846 --> 11:09.616
we need to specify the pod selector,

11:10.687 --> 11:12.330
pod selector

11:13.944 --> 11:16.251
and match labels.

11:17.506 --> 11:22.623
We want to allow egress traffic
to the pod payroll

11:22.723 --> 11:26.363
so we're going to give it a name, payroll.

11:31.606 --> 11:34.156
We also want to specify ports.

11:39.016 --> 11:49.952
We want to allow protocol TCP
to port so to payroll it's 8080.

11:52.540 --> 11:53.626
That's the first rule.

11:55.743 --> 11:58.036
The same way we're going
to have for the second rule,

11:58.576 --> 11:59.923
we need to specify

12:00.863 --> 12:03.496
to which pod as well to which port.

12:09.229 --> 12:11.265
Let's just check it here,
it should be each one

12:11.266 --> 12:18.235
will have two end ports
so it's actually ports then I fix that.

12:22.447 --> 12:27.436
Within this,
we're going to have pod selector,

12:28.975 --> 12:36.263
then we're going to have match labels
and then we have MySQL.

12:39.790 --> 12:43.246
That's the second pod,
then we're going to have ports,

12:43.846 --> 12:49.326
then we specify the protocol
which happens to be TCP

12:50.952 --> 12:56.615
and of port for MySQL
is 3306 as you can see here.

12:57.967 --> 13:03.382
This particular policy,
we're going to remove egress from here.

13:04.533 --> 13:11.655
What it does it creates an internal policy
for the internal pod using this label.

13:11.656 --> 13:17.612
Everything has a label with a name on it
and then we're allowing egress

13:17.690 --> 13:22.161
to the payroll pod on port 8080

13:22.761 --> 13:29.713
and then on the MySQL pod on port 3306.

13:33.112 --> 13:36.450
Let's create that policy.

13:40.576 --> 13:41.886
Let's do a describe

13:44.994 --> 13:47.520
internal policy

13:49.035 --> 13:50.035
and we verify

13:50.585 --> 13:51.622
and the pod selector

13:52.382 --> 13:54.605
and the egress traffic configuration.

13:55.696 --> 14:00.426
We have 8080 to payroll
on 3306 to MySQL is configured.

14:01.096 --> 14:03.316
You'll have egress policy is configured.

14:03.647 --> 14:04.647
Check it out.

14:05.709 --> 14:09.556
That's about it
and that's the end of this lab.