---

✅ Validated for OpenShift 4.16.30 (Kubernetes v1.29.10)

---

🧱 Objective

• Deploy a simple Apache HTTP server using openshift/httpd
• Deploy a test pod to simulate network access
• Apply NetworkPolicy to:
  • Allow or deny access based on pod labels and namespaces

---

📦 Step 1: Pre-Requisites

• You must have:
  • A running OpenShift 4.16+ cluster
  • Access to the oc CLI
  • Permissions to create NetworkPolicy in your namespace

oc login --token=xxx --server=https://your-cluster-api:6443
oc new-project netpol-demo

---

🌐 Step 2: Deploy Apache HTTP Server

oc new-app --name=my-httpd --image-stream=openshift/httpd

This will:

• Deploy the httpd pod
• Create a Service named my-httpd

🔍 Confirm deployment:

oc get pods
oc get svc

---

🧪 Step 3: Deploy a Test Pod to Simulate Access

oc run test-client --image=registry.access.redhat.com/ubi8/ubi --command -- sleep 3600

Wait a few seconds, then exec into it:

oc exec -it pod/test-client -- bash
curl http://my-httpd:8080

✅ You should see an HTTP response (e.g., HTML page)

---

🔒 Step 4: Apply a Deny-All NetworkPolicy

Now apply a default deny-all ingress policy:

# deny-all.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

oc apply -f deny-all.yaml

🔍 Test again:

oc exec -it pod/test-client -- curl http://my-httpd:8080

❌ It should now fail with timeout — all ingress is blocked.

---

✅ Step 5: Allow Access Only from Labeled Pods

Label your test-client pod:

oc label pod test-client access=httpd-client

Create a NetworkPolicy to allow only pods with that label:

# allow-httpd-from-labeled-pods.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-httpd-from-specific-pod
spec:
  podSelector:
    matchLabels:
      app: my-httpd
  ingress:
  - from:
    - podSelector:
        matchLabels:
          access: httpd-client
  policyTypes:
  - Ingress

oc apply -f allow-httpd-from-labeled-pods.yaml

🔍 Re-test:

oc exec -it pod/test-client -- curl http://my-httpd:8080

✅ Access is restored only for labeled pod.

---

🛡️ Step 6: Add a Pod in Another Namespace to Prove Isolation

Create another namespace:

oc new-project outside-namespace

Run a test pod:

oc run outsider --image=registry.access.redhat.com/ubi8/ubi --command -- sleep 3600

Try accessing:

oc exec -it pod/outsider -n outside-namespace -- curl http://my-httpd.netpol-demo.svc:8080

❌ Should fail — external namespace is blocked by policy

---

✅ Summary of What You Experienced

Scenario	Access Status
Any pod (no policy)	✅ Allowed
After Deny-All	❌ Blocked
Labeled pod with allow policy	✅ Allowed
External namespace pod	❌ Blocked

---

📘 Key Concepts Practiced

Concept	What You Did
NetworkPolicy	Controlled access to httpd service
PodSelector	Matched specific workloads by label
NamespaceScope	Isolated access from other namespaces
Testing access	Used curl from test pods

---