06 · KubernetesLab 40 / 59
Challengekubernetes
Kubernetes Security Hardening (NetworkPolicies) & HPA — Challenge
Deny traffic between Pods by default, then allow only what the application needs — and scale it under load.
- Time
- 23 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Low cost
Where this fits in the platform
Already built
This lab adds
- Default-deny networking, admission-enforced hardening, autoscaling
Before you start
Cost — Low cost
Depends on an existing cluster. NetworkPolicies and HPA objects are free; the cluster and any nodes the HPA scales up are not.
The goal#
Build Kubernetes Security Hardening (NetworkPolicies) & HPA yourself, starting from an empty directory, without following the guided steps.
Everything you need is in the criteria above. Work down them one at a time, and verify each before moving to the next.
Hands-on environment
Run this lab in a real terminal, free and in your browser. The environment is temporary and yours alone — break it as much as you like.
Start the challengeOpens in Killercoda, in a new tab — keep this page open for the steps.
This is the guided lab's environment — the same machine, with its walkthrough on the left. Work from the task above and leave those steps alone until you are done, or you are reading the answers.
Run it on your own machine
Run this lab on your own machine. One command starts the environment, with everything the lab needs already installed:
Run `./egykode cluster calico` first — on the default kind CNI a NetworkPolicy is accepted and ignored, so the challenge would pass without blocking any traffic.
You will need:
- docker
- kubectl
- kind
git clone https://github.com/EgyKode/EgyKode-lab.git
cd EgyKode-lab
./egykode start k8s
./egykode shellYou need Docker and Git installed. Everything else runs inside the environment. The first start downloads it and takes a few minutes; later starts are seconds.
Not sure what you already have? Run: npm run doctor — it checks and changes nothing.
Run it on AWS
This lab builds real cloud infrastructure, so it needs your own AWS account. Follow the cost and cleanup notes above — the resources are yours, and so is the bill.
Anything you tick here is your own record. EgyKode cannot see inside that terminal, so the success criteria stay self-assessed even when the environment checks your work for you.
Rules#
- Do not open the guided lab until you have genuinely tried.
- When something fails, read the error before you search. The error message is the lesson.
- Tear down anything billable as soon as you finish.
If you get stuck#
The guided lab is one click away at the bottom of this page. Using it is not failure — coming back and repeating the challenge afterwards is the point.
You are done when
0 of 4
The concept behind it
Phase complete · 06 Kubernetes
You can now: The application runs on Kubernetes with storage, routing, scoped permissions, network policy and autoscaling.
Next phase
Lab 40 of 59 on the project path