Hands-on Lab·Certified Kubernetes Administrator
NetworkPolicy Patterns
Allow a whole namespace, then restrict egress and watch the Pod lose DNS while still reaching the same backend by IP. That one result explains more about NetworkPolicy than any diagram, and the AND-versus-OR distinction in a from block is the bug behind most broken policies.
Services and Networking Guide 62 of 103 Advanced
- Kubernetes1.36.4
- CNICalico v3.32.1
- Cluster4 nodes
- CoreDNSv1.14.2
- TimeAbout 40 min
- Reviewed21 August 2026
Written against the versions above. The kube-dns pod label `k8s-app: kube-dns` is what the DNS allowance matches. Verify it on your cluster before copying.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- The default-deny guide. This one continues from its Pods and policies.
- The CoreDNS guide, because the central lesson here is what happens when a Pod loses DNS.
- A CNI that enforces NetworkPolicy.
-
Allow a whole namespace, and see policies add up
-
Restrict egress, and break the Pod in an unexpected way
-
The DNS allowance, and AND versus OR
-
Everything back on, verified together