Only the API pod may reach the database, on 3306.
You'll learn to
write a policy with pod + namespace selectors
Recap
- 1podSelector = target · from = who gets in · ports
- 2One dash = AND, two dashes = OR
- 3Default deny: podSelector: {} with no rules
Check yourself
One from item holds podSelector role=api AND namespaceSelector prod. Who gets in?
6.18
Stamp this lesson
Watched it and passed the check? Mark it in your logbook.