Completed upto lesson 28

lab/README.md

@@ -0,0 +1,37 @@
+# Isolated CKS NetworkPolicy lab
+
+This lab runs in the local Kind context `kind-cks-lab`, separate from the pre-existing `monitoring-context` cluster.
+
+## Scenario
+
+`api` and `intruder` are clients. `db` serves HTTP on port 8080. The policy allows only pods labelled `app=api` to reach the database.
+
+## Repeat the proof
+
+```powershell
+kubectl --context kind-cks-lab -n cks-lab exec api -- wget -qO- -T 5 http://db:8080
+kubectl --context kind-cks-lab -n cks-lab exec intruder -- wget -qO- -T 5 http://db:8080
+```
+
+The first command must print `database`. The second must time out, which proves the denial.
+
+## Inspect the answer
+
+```powershell
+kubectl --context kind-cks-lab -n cks-lab get networkpolicy db-only-from-api -o yaml
+kubectl --context kind-cks-lab -n cks-lab get pods --show-labels
+```
+
+The policy is in `networkpolicy-lab.yaml`. Edit it for new drills, then run:
+
+```powershell
+kubectl --context kind-cks-lab apply -f .\lab\networkpolicy-lab.yaml
+```
+
+## Cleanup
+
+This is destructive and removes only the isolated Kind cluster:
+
+```powershell
+.\lab\bin\kind.exe delete cluster --name cks-lab
+```