# Guided Exercise: Planning Network Isolation

Paper-and-thinking exercise before the Lab.

## The scenario

A `database` Pod (label `app=database`) in the `netpol` namespace should only ever be reachable
by Pods labeled `role=backend` — not the frontend, not anything else in the cluster.

## Your task

1. Before writing any YAML: right now, with NO NetworkPolicy in place, can the frontend reach
   the database? Why?
2. What would a NetworkPolicy that ONLY specifies `podSelector: { matchLabels: { app: database
   } }` and no `ingress` rules at all do to traffic reaching the database — including from
   `role=backend` Pods?
3. Sketch (in words, not full YAML) what the `ingress` rule needs to say to allow ONLY
   `role=backend` traffic in.
4. If a new Pod is later created with `role=backend` in a DIFFERENT namespace, would your policy
   as sketched in #3 allow it? What would need to change if cross-namespace access should be
   allowed?

## A worked answer to check yourself against

1. Yes — by default, every Pod can reach every other Pod regardless of labels or namespace
   (ROOT 07's Ingress & NetworkPolicy lesson). Nothing restricts this until a policy exists.
2. It would block ALL incoming traffic to the database, including from `role=backend` — an
   empty `ingress` list under a policy that selects the Pod means "no traffic is allowed in,"
   not "no policy applies."
3. An `ingress` rule with `from: [{ podSelector: { matchLabels: { role: backend } } }]` — this
   allows traffic specifically from Pods carrying that label, and nothing else.
4. Not automatically — a bare `podSelector` in the `from` clause matches Pods in the SAME
   namespace as the policy by default. Allowing a different namespace requires adding a
   `namespaceSelector` alongside the `podSelector` in the same `from` entry.

## Instructor Notes

**Facilitation:** Question 2 is the one most likely to trip students up — it directly reinforces
the "empty ingress rules means deny-all, not no-op" point from the lesson, which is worth
confirming actually landed before the Lab.

**Approximate timing:** 10-12 minutes live with discussion; 10 minutes self-paced.

**Optional extension:** ask what a security-minded team would ALSO want to restrict about this
database Pod's OWN outbound (egress) traffic, beyond who can reach it — a light forward pointer
to ROOT 09's security-control framing of NetworkPolicy, without requiring students to build an
egress rule here.