I85PREP
⌘ K
CKA study materials
CKA study resources

CKA (Other exams): Services & Networking

CKA · Work through your exam, one topic at a time.

All guide sections

Services & Networking

The Services & Networking domain covers how Pods find and reach each other: Service types and endpoints, CoreDNS names, Ingress resources, and NetworkPolicies. CKA tasks often ask you to expose an app, fix a Service with no endpoints, or write a policy that permits only one traffic path.

Core rules

  • A Service selects Pods by labels. If the selector matches no Ready Pod, the Service has no endpoints and connections fail even though the Service exists.
  • ClusterIP is internal; NodePort adds a port on every node; LoadBalancer requests an external load balancer; ExternalName returns a CNAME. port is the Service port, targetPort is the container port.
  • CoreDNS resolves service.namespace.svc.cluster.local; short names work within the same namespace. Headless Services (clusterIP: None) return Pod IPs directly.
  • NetworkPolicy is namespaced and additive. An empty podSelector selects all Pods in the namespace; a policy with no egress rules denies all egress for selected Pods. The CNI plugin must enforce policies.
  • Ingress requires an Ingress controller and a rule with host/path and a backend Service.

Worked example

Create a default-deny ingress policy in namespace prod, then allow Pods labeled app=frontend to reach app=backend on TCP 8080. First apply a policy selecting all Pods with policyTypes: [Ingress] and no ingress rules. Then apply a second policy selecting app=backend with an ingress rule from podSelector: matchLabels: app=frontend and ports: port: 8080. The reasoning: policies are additive, so the second policy opens only that path; other sources remain denied by the first. Verify with kubectl get networkpolicy and test from a frontend Pod using wget -qO- backend:8080.

Traps

  • A NetworkPolicy namespaceSelector and podSelector in the same from peer are ANDed; putting them in separate peers makes them ORed.
  • Forgetting that egress denial also blocks DNS; allow UDP/TCP 53 to kube-dns if the selected Pods must resolve names.
  • A Service with the wrong targetPort still gets endpoints but connections time out; endpoints reflect readiness, not port correctness.
  • Ingress without a controller has no effect; check the IngressClass and controller Pods.
  • NetworkPolicy does not apply to hostNetwork Pods the same way, and not all CNIs support every field.