Microservices shop, mission 5 of 7
Outbound only
advanced, about 15 minutes, in the Kubernetes Simulator
Opens once you pass Need to know.
The briefing
From Dana Kowalski, on-call lead at Larchwood (a fictional company)
The pen test came back: from a frontend pod they could reach admin, our internal admin API. The frontend has no business calling anything but catalog and cart.
Lock its outbound traffic down to exactly that. frontend-egress.yaml is a start. Test it from a frontend pod before you call it done — a dropped connection says nothing, it just hangs.
What you'll do
- The frontend can't reach admin
- …but still reaches catalog and cart by name
- Customers still load the shop at shop.local
- Bonus star: Test from a frontend pod with curl -m
The mission checks the cluster, not your keystrokes: any fix that works, passes.
Concepts
Egress policies
A NetworkPolicy with
Read the Kubernetes docspolicyTypes: [Egress]limits what the pods it selects may connect to. Once one selects a pod, only listed destinations are allowed — DNS included, so pods must be allowed to reach kube-dns on port 53. Ports are the destination pod's, not the Service's: traffic through a Service arrives on its targetPort.
Read first
More Microservices shop missions
- 1. Find each other
- 2. Wrong door
- 3. One front door
- 4. Need to know
- 5. Outbound only
- 6. A fixed address
- 7. Moved out