WIUNIX ACADEMY
Kubernetes NetworkPolicy: prove default deny, DNS and one allowed path
Page 3 of 3. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment4 editable values
LET’S BUILD
Verify both allowed and forbidden paths
The allowed client must resolve and reach API; stranger may resolve DNS but must not reach API. Test a direct IP to avoid mistaking DNS failure for application denial. If stranger succeeds, inspect all policies and labels rather than assuming a narrower new policy can override an older allow. Standard policy has no explicit deny priority.
The BusyBox nslookup controls shown exercise the default DNS transport; they do not explicitly prove TCP DNS. The policy allows UDP and TCP53, but explicit TCP acceptance needs an approved diagnostic tool with a TCP DNS query in your own environment.
Operator terminal; authorized lab context
cd '/tmp/academy-netpol' || exit 1
kubectl --context='lab' create -f allow.yaml
kubectl --context='lab' -n 'academy-lab' exec client -- nslookup api
kubectl --context='lab' -n 'academy-lab' exec client -- wget -Y off -T 3 -qO- http://api:8080/hostname
kubectl --context='lab' -n 'academy-lab' exec stranger -- nslookup api
kubectl --context='lab' -n 'academy-lab' exec stranger -- wget -Y off -T 3 -qO- 'http://10.96.20.30:8080/hostname'
kubectl --context='lab' -n 'academy-lab' get networkpolicy -o yamlDNS succeeds for both; HTTP succeeds only for client and fails for stranger while server stays healthy.
LET’S BUILD
Remove only the lab policies, then retire the owned fixture
Optional rollback removes these exact policy objects and restores the pre-policy lab baseline, not a universal allow if clusterwide policies exist. The final deletion below is destructive only to this owner-created disposable namespace and its contents. Verify its lab label and contents before running it; never substitute a shared namespace. Retain the acceptance matrix first.
Operator terminal; authorized lab context
cd '/tmp/academy-netpol' || exit 1
kubectl --context='lab' delete -f allow.yaml -f deny.yaml
kubectl --context='lab' -n 'academy-lab' exec stranger -- wget -Y off -T 3 -qO- http://api:8080/hostname
kubectl --context='lab' get namespace 'academy-lab' --show-labels
kubectl --context='lab' -n 'academy-lab' get all
# Only after confirming this is exclusively the disposable lab:
kubectl --context='lab' delete namespace 'academy-lab'Baseline returns before cleanup; only the confirmed disposable namespace is retired.
Know what this acceptance does not cover
This documented recipe has not been executed against your CNI. A passing lab is evidence for these labels, ports and fresh connections, not application identity, TLS authorization, all host traffic or every policy implementation. Promote the minimal policy through the owning source/review workflow and include explicit dependency/DNS tests in future changes.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.