Protecting a Shop's Stock Service is a practical project for learners who have completed Kubernetes foundations. Keep a real customer catalogue and training basket quotes working through the shop API while preventing direct stock reads and unnecessary API connections. Use the complete application result to judge your network boundary.
Two Guided Labs teach stock ingress, actual DNS and stock dependencies, positive controls and the union of policy permissions. One independent Challenge changes the namespaces, role values, products and stock port for a craft shop. Every unit starts with its own prepared environment; no previous VM files or processes are required.
What You Will Learn
After completing this course, you will be able to:
- follow the real customer → API → stock request path and distinguish it from an internal bypass;
- combine namespace and Pod role selectors to restrict inventory ingress without stopping the application;
- distinguish a DNS failure from a working or blocked TCP connection using real requests from prepared identities;
- allow the API's required DNS and stock paths, including UDP and TCP DNS, while keeping the scope focused;
- inspect the union of NetworkPolicies and retire an old managed allowance that still grants unnecessary access;
- deliver reusable policy manifests while preserving the complete catalogue, correct training quotes and an independent service.
Who This Course Is For
This course is for Kubernetes beginners ready to apply foundational networking to a complete application task. Study the introductory networking and NetworkPolicy work in Kubernetes in Practice before starting this project.
Prerequisites: Basic terminal paths and Tab navigation, simple YAML, and familiarity with namespaces, Pods, Deployments, Services and labels. The guided work explains policy fields, DNS transports and ports, the diagnostic tool and the one terminal variable it uses.
Learning environment: A prepared real single-node Kubernetes cluster with Calico, a customer application, API, stock service and separate dispatch service are provided. Use Workspace, Shop and Reference Tabs to configure policies, browse the original application and test real allowed and denied connections. The website, labels and command output are in English. All business data is synthetic.
Frequently Asked Questions
Do I need prior Kubernetes experience?
Yes. You should recognise basic cluster objects and read simple YAML. This project applies those foundations to an application boundary and explains the additional policy and DNS decisions as they appear.
Do I need to build an application or configure a network plugin?
No. The real cluster, plugin and application are prepared. You edit scoped NetworkPolicies and test the actual services. Training basket quotes do not reserve stock, place an order or take a payment.
How does the Challenge extend the Guided Labs?
The craft shop changes the namespaces, roles, products and inventory port. Apply the same ingress, DNS, egress and policy-union methods to its actual scope, preserving both allowed and denied paths rather than copying the old values.
Does this establish production security or continuous availability?
No. These are finite functional TCP/UDP checks on a prepared single-node cluster. NetworkPolicy controls selected Pod network connections; it does not provide customer authentication or prove protection against node or administrator access, or uninterrupted production availability.
