Microservices shop, mission 4 of 7
Need to know
advanced, about 12 minutes, in the Kubernetes Simulator
Opens once you pass One front door.
The briefing
An audit found that any pod in the cluster can call catalog's API. Security wants it reachable only from the frontend — and, since customers load items straight from /api/catalog, from the ingress controller.
A NetworkPolicy that selects a pod isolates it: from then on, only the traffic some policy allows gets in. Everything else is silently dropped — no error, just a connection that never answers. catalog-policy.yaml is a start.
The ingress controller runs in the ingress-nginx namespace. A podSelector alone only matches pods in the policy's own namespace; a namespaceSelector matches namespaces by label, and every namespace carries kubernetes.io/metadata.name: <its name>.
What you'll do
- The cart can no longer reach catalog
- The frontend still reaches catalog
- Customers still load items at shop.local/api/catalog/items
- Bonus star: Prove the cart is shut out: curl catalog from a cart pod
The mission checks the cluster, not your keystrokes: any fix that works, passes.
Read first
More Microservices shop missions
- 1. Find each other
- 2. Wrong door
- 3. One front door
- 4. Need to know
- 5. Outbound only
- 6. A fixed address
- 7. Moved out