Lab 02: Network Policies in OKS

Lab Objectives

• Learn how to test and implement Network Policies on an OKS cluster

Prerequisites

1. A running Kubernetes cluster provided by OKS.
2. Access to the kubectl CLI.
3. Administrator privileges on the cluster.

Retrieve the kubeconfig file

oks-cli cluster kubeconfig --cluster-name my-cluster --project-name my-project > kubeconfig.yaml
export KUBECONFIG=./kubeconfig.yaml

Test the cluster

kubectl get nodes

Deploy a test environment

Create a dedicated namespace:

kubectl create namespace test-network-policy

Deploy frontend and backend applications

Create a deployments.yaml file:

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
  namespace: test-network-policy
  labels:
    app: frontend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
        - name: frontend
          image: nginx
          ports:
            - containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  namespace: test-network-policy
  labels:
    app: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
    spec:
      containers:
        - name: backend
          image: hashicorp/http-echo
          args:
            - "-text=Hello from Backend"
          ports:
            - containerPort: 80

Apply the deployment:

kubectl apply -f deployments.yaml

Create a service to expose the backend

Create a backend-svc.yaml file:

---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: test-network-policy
spec:
  selector:
    app: backend
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80 # find the correct port using kubectl logs pods

Apply the service:

kubectl apply -f backend-svc.yaml

Verify created resources:

kubectl get pods,svc -n test-network-policy

Test connectivity without Network Policy

Run this command from the frontend:

kubectl exec -it deployment/frontend -n test-network-policy -- curl -m 5 backend.test-network-policy.svc.cluster.local:80

Apply a restrictive Network Policy

Create a deny-all.yaml file:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: test-network-policy
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress: []

Apply the rule:

kubectl apply -f deny-all.yaml

Test the connection again:

kubectl exec -it deployment/frontend -n test-network-policy -- curl -m 5 backend.test-network-policy.svc.cluster.local:80

❌ Expected: connection is blocked (timeout or connection refused).

Allow only frontend to access backend

Create an allow-frontend.yaml file:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: test-network-policy
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80

Apply the rule:

kubectl apply -f allow-frontend.yaml

Test again:

kubectl exec -it deployment/frontend -n test-network-policy -- curl -m 5 backend.test-network-policy.svc.cluster.local:80

✅ Expected: connection is allowed.

Test with another pod (should be blocked):

kubectl run busybox --rm -it --image=busybox --restart=Never -- /bin/sh
wget backend.test-network-policy.svc.cluster.local:80

❌ Expected: connection refused.

Cleanup

Delete the Network Policies:

kubectl delete networkpolicy deny-all allow-frontend -n test-network-policy

Delete created resources:

kubectl delete namespace test-network-policy

Conclusion

• Without Network Policy, all pods can communicate.
• With deny-all, everything is blocked.
• With allow-frontend, only frontend can access backend.
• Testing with another pod confirms that access is restricted.