1.题目

Only pods that in the internal namespace can access to the pods in mysql namespace via port 8080/TCP.

2.解析

本题目考测network policy，题意为只有在命空间为internal的pod，才可以通过TCP协议8080端口访问到在命名空间为mysql的pod，因此使用NP的ingress来解答。

3.答案

https://kubernetes.io/docs/concepts/services-networking/network-policies/

1. 拷贝官方案例，然后根据题意修改

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
   name: test-network-policy
   namespace: mysql
   spec:
   podSelector: {}
   policyTypes:
   - Ingress
   ingress:
   - from:
    - namespaceSelector:
        matchLabels:
          ns: internal
    ports:
    - protocol: TCP
      port: 8080

2. 查看internal命名空间是否有标签 ns=internal，如果没有，需要设置标签

   # 查看标签
   kubectl get ns internal --shwo-labels
   # 设置标签
   kubectl label ns internal ns=internal