Skip to content
EgyKode
Guided lab

Kubernetes Security Hardening (NetworkPolicies) & HPA

47 minIntermediate

This creates billable resources. Run it in a dev environment and destroy it when you finish. Set a budget alarm first.

Success criteria

0 of 4

What you are building#

What is a Kubernetes NetworkPolicy?#

By default in Kubernetes, pod networking is an open flat network model: every pod can communicate with every other pod across all namespaces. In production enterprise environments, this presents a severe security vulnerability. If an attacker compromises a single public-facing pod, they can pivot laterally across the cluster network to access database pods or internal APIs.

A NetworkPolicy acts as an in-cluster zero-trust firewall operating at Layers 3 and 4 (IP address and TCP/UDP port). It enforces packet filtering directly on pod virtual network interfaces (veth) using the underlying Container Network Interface (CNI) plugin (e.g. AWS VPC CNI / Calico).

What is HorizontalPodAutoscaler (HPA)?#

The HorizontalPodAutoscaler (HPA) automatically scales the number of running pod replicas in a Deployment, StatefulSet, or ReplicaSet up or down based on real-time resource metrics (CPU and Memory utilization) collected from worker node Kubelets by the Metrics Server.

text
                                ZERO-TRUST POD SECURITY & AUTOSCALING
                                
  [ Public Internet ]
           |
           | HTTP / Port 80
           v
  +-----------------------------------------------------------------------------------+
  |  AWS Application Load Balancer (ALB Ingress)                                      |
  +----------------------------------------+------------------------------------------+
                                           |
                                           | ALLOW Ingress Port 8000
                                           v
  +-----------------------------------------------------------------------------------+
  |  KUBERNETES NAMESPACE: nti-devops                                                 |
  |                                                                                   |
  |  +-----------------------------------------------------------------------------+  |
  |  |  DJANGO APPLICATION PODS (Deployment: 2 to 6 Replicas via HPA)              |  |
  |  |  +------------------------+             +------------------------+          |  |
  |  |  | Pod 1 (IP: 10.0.1.42)   |             | Pod 2 (IP: 10.0.2.89)   |        |  |
  |  |  +------------------------+             +------------------------+          |  |
  |  +-------------------------------------+---------------------------------------+  |
  |                                        |                                          |
  |                                        | ALLOW Egress Port 5432                   |
  |                                        v                                          |
  |  +-----------------------------------------------------------------------------+  |
  |  |  DATABASE POD / AWS RDS POSTGRESQL (Port 5432)                              |  |
  |  +-----------------------------------------------------------------------------+  |
  |                                        ^                                          |
  |                                        | BLOCKED by NetworkPolicy                 |
  |  +-------------------------------------+---------------------------------------+  |
  |  |  UNAUTHORIZED / COMPROMISED POD (In any Namespace)                          |  |
  |  +-----------------------------------------------------------------------------+  |
  +-----------------------------------------------------------------------------------+

Steps#

Step 1: Connect to EKS Cluster & Change Directory#

Terminal
aws eks update-kubeconfig --name nti-devops-eks --region us-east-1
cd 04-Kubernetes-Orchestration/Lab13-K8s-Security-Autoscaling

Step 2: Apply NetworkPolicy & HPA Manifests#

Terminal
kubectl apply -f networkpolicy.yaml
kubectl apply -f horizontalpodautoscaler.yaml

Step 3: Monitor Live HPA Metrics#

Terminal
kubectl get hpa -n nti-devops -w

Step 4: Simulate Heavy CPU Load to Test HPA Scaling#

In a separate terminal, launch a temporary generator pod to send concurrent HTTP requests:

Terminal
kubectl run -i --tty load-generator --rm --image=busybox --namespace=nti-devops -- /bin/sh -c "while true; do wget -q -O- http://nti-django-svc:8000/; done"

Verify it worked#

1. Verify NetworkPolicy Status#

Terminal
kubectl get networkpolicy -n nti-devops

Expected Output:

text
NAME                        POD-SELECTOR          AGE
nti-django-network-policy   app=nti-django-app    1m

2. Verify HPA Auto-Scaling Response Under Load#

Terminal
kubectl get hpa -n nti-devops

Expected Output:

text
NAME             REFERENCE                   TARGETS           MINPODS   MAXPODS   REPLICAS   AGE
nti-django-hpa   Deployment/nti-django-app   145%/80%, 60%/80%   2         6         5          3m

3. Verify Deployment Pod Count Scaling#

Terminal
kubectl get pods -n nti-devops -l app=nti-django-app

Expected Output:

text
NAME                              READY   STATUS    RESTARTS   AGE
nti-django-app-6d8b9f7c4d-a1b2c   1/1     Running   0          4m
nti-django-app-6d8b9f7c4d-d5e6f   1/1     Running   0          4m
nti-django-app-6d8b9f7c4d-g7h8i   1/1     Running   0          90s
nti-django-app-6d8b9f7c4d-j9k0l   1/1     Running   0          90s
nti-django-app-6d8b9f7c4d-m1n2o   1/1     Running   0          45s

Clean up#

Run this even if you did not finish. Everything above is destroyable, and an account full of half-built experiments is how a surprise bill starts.

Destructive — This removes real resources. Check which environment you are in first.

Terminal
kubectl delete networkpolicy --all -A
kubectl delete hpa --all -A
kubectl get nodes  # confirm the HPA did not leave extra nodes running

Cost of this lab: Depends on an existing cluster. NetworkPolicies and HPA objects are free; the cluster and any nodes the HPA scales up are not.

The concept behind it

Ready to try it without help?Do the challenge