# Isolated CKS NetworkPolicy lab

This lab runs in the local Kind context `kind-cks-lab`, separate from the pre-existing `monitoring-context` cluster.

## Scenario

`api` and `intruder` are clients. `db` serves HTTP on port 8080. The policy allows only pods labelled `app=api` to reach the database.

## Repeat the proof

```powershell
kubectl --context kind-cks-lab -n cks-lab exec api -- wget -qO- -T 5 http://db:8080
kubectl --context kind-cks-lab -n cks-lab exec intruder -- wget -qO- -T 5 http://db:8080
```

The first command must print `database`. The second must time out, which proves the denial.

## Inspect the answer

```powershell
kubectl --context kind-cks-lab -n cks-lab get networkpolicy db-only-from-api -o yaml
kubectl --context kind-cks-lab -n cks-lab get pods --show-labels
```

The policy is in `networkpolicy-lab.yaml`. Edit it for new drills, then run:

```powershell
kubectl --context kind-cks-lab apply -f .\lab\networkpolicy-lab.yaml
```

## Cleanup

This is destructive and removes only the isolated Kind cluster:

```powershell
.\lab\bin\kind.exe delete cluster --name cks-lab
```