Cloud › Module 7 › Lesson 2
Network Policies
Network policy literacy — default deny, pod selector, ingress/egress rules — on kind YOUR cluster lab namespace.
Visual · t31_network_policies
Network policies = named segmentation rows. kind YOUR cluster. Original Cyberlium.
Opening
Flat pod networks let lateral movement spread — name NetworkPolicy fields on YOUR kind lab before assuming prod mesh will save you.
Network policy literacy names: default-deny stub category, podSelector and namespaceSelector, ingress rule (from pods/labels category), egress rule (to DNS/kube-api category literacy), and policy ordering note. Analyst drafts NetworkPolicy manifest for `$CLOUD_LAB` kind YOUR cluster lab namespace — documents intended allow paths for one frontend/backend lab pair — without testing policies by attacking stranger pods, without disabling CNI on shared clusters, without prod network policy apply without RoE. Cyberlium teaches segmentation vocabulary — defender micro-segmentation literacy — NOT lateral movement between unauthorized namespaces. Refused: unauthorized prod policy apply, policy bypass attack repro, stranger cluster pod scanning. Lab row: NetworkPolicy YAML stub with default-deny plus two allow rules annotated.
1. Named policy fields
podSelector, policyTypes, ingress, egress, namespaceSelector — five literacy anchors.
Default-deny baseline then explicit allow — document order on lab manifest.
Command guide
Try these commands — Named policy fields
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: NetworkPolicy (https://kubernetes.io/docs/concepts/services-networking/network-policies/); K8s network plugins (https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/); CNI security (https://kubernetes.io/docs/concepts/cluster-administration/networking/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab namespace pair
Frontend/backend lab pair on kind — label selectors match YOUR deploy names.
DNS egress allow row documented — common literacy gap.
3. Refused
No unauthorized prod policy apply; no lateral movement validation on stranger pods.
Network policy literacy supports segmentation — not offensive pivot testing.
4. What you ship: NetworkPolicy manifest stub
Default-deny + two allow rules + annotation + NEVER stranger pod attack line.
5. What you record before the next lesson
NetworkPolicy manifest stub path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pivot between stranger Kubernetes namespaces to 'test if policy works.'
Right
NetworkPolicy stub for kind YOUR cluster lab namespace. Next: Secrets Hygiene.
Mission: NetworkPolicy manifest stub
1) Name five NetworkPolicy fields. 2) Default-deny baseline. 3) Two explicit allow rules. 4) Write NEVER stranger pod pivot line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “DNS egress — minimum allow literacy?”
Knowledge Check
APPLY: Network policy literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Lateral movement between stranger pods is lab.
True or False
Knowledge Check
APPLY: Default-deny means:
Multiple choice