Every Pod is Ready and the market is still down, because nothing can reach anything. The repair order follows the traffic, from the outside in.

The Service layer

kubectl get endpoints
kubectl get svc market-api -o jsonpath='{.spec.ports[0]}'

Endpoints first: every Service should list its Ready Pods. Then ports: targetPort must be the port the container serves. Chapter 13's checklist, applied to each Service in turn.

The policies

The survey found default-deny and one allow rule. That rule lets the API reach the database, and nothing else is allowed in. Add the rest as allow rules on the receiving side, keeping default-deny in place:

kind: NetworkPolicy
metadata:
  name: api-from-web-and-ingress
spec:
  podSelector:
    matchLabels:
      app: market-api
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: market-web
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - port: 8080

The second from entry is the ingress controller. It is a Pod in kube-system, and it is subject to your default deny like any other caller. The web needs the same treatment on port 80.

The Ingress

kubectl get ingress market -o jsonpath='{.spec.rules[0].http.paths[*].backend.service.name}'
curl -s -H "Host: market.example" http://10.0.0.10/monsters

A 503 from a rule whose Pods are Ready means the controller found no Service by that name. Read the backend names against kubectl get svc; a one-letter typo survives every other check.

The keys

The team deploys through a ServiceAccount named deploy. Confirm what it can do, then grant only what the handover needs:

kubectl auth can-i patch deployments --as=system:serviceaccount:market:deploy
kubectl create role rollout --verb=get,list,patch,update --resource=deployments
kubectl create rolebinding deploy-rollout --role=rollout --serviceaccount=market:deploy

set image is a patch on a Deployment. That is the whole grant.