Kubernetes Simulator

advanced · ~15 min

Outbound only

Ticket from Dana Kowalski, on-call lead

The pen test came back: from a frontend pod they could reach admin, our internal admin API. The frontend has no business calling anything but catalog and cart.

Lock its outbound traffic down to exactly that. frontend-egress.yaml is a start. Test it from a frontend pod before you call it done — a dropped connection says nothing, it just hangs.

Egress policies

A NetworkPolicy with policyTypes: [Egress] limits what the pods it selects may connect to. Once one selects a pod, only listed destinations are allowed — DNS included, so pods must be allowed to reach kube-dns on port 53. Ports are the destination pod's, not the Service's: traffic through a Service arrives on its targetPort. Docs

Objectives

  • The frontend can't reach admin
  • …but still reaches catalog and cart by name
  • Customers still load the shop at shop.local
  • Bonus: Test from a frontend pod with curl -m

Best on a computer with a keyboard. It works on a phone, with shortcuts under the terminal.