About this scenario
The platform team wants every team namespace isolated: a default-deny NetworkPolicy that blocks incoming traffic unless another policy allows it. A colleague wrote the default-deny GeneratingPolicy last week, and team-c, created since, got its copy.
team-a and team-b are older than the policy and have nothing. A client Pod in team-b can call web in team-a freely. And a policy someone deletes by hand stays deleted.
Make Kyverno cover the namespaces that already exist and put back copies that go missing. One namespace must stay open: shared, labelled network-policy=open, hosts the docs Service that every team calls. The policy is in the editor as default-deny-gpol.yaml.
Objectives
- See which namespaces have a default-deny policy
- Kyverno generates default-deny in team-a and team-b
- client in team-b can no longer reach web in team-a
- Delete default-deny in team-a and see Kyverno put it back
- shared stays open: team-a still reaches docs.shared
- team-c keeps its generated policy
What you'll practice
- A
GeneratingPolicy creates objects when a trigger matches, with generator.Apply(namespace, objects) in CEL. Its matchConstraints name the trigger, here the creation of a Namespace. generateExisting applies the policy to triggers that were there before it. Without it only new ones count.synchronize keeps the generated objects in line with the policy. Deleting or editing a copy is undone within seconds, and deleting the policy removes the copies.- A default-deny for Ingress blocks traffic from other namespaces and from inside the namespace. Teams then add their own policies to allow what they need.
- Scope a generating policy with
matchConditions. Labels on the namespace make the exception visible to anyone who runs kubectl get ns --show-labels.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Helm, Flux, Argo CD, Kyverno, Cilium, Istio) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.