CKS mastery journey · Fresh transfer

Two-sided NetworkPolicy isolation

Secure current and future workloads while composing namespace, Pod, port, DNS, and CIDR restrictions without unintended additive access.

Cluster SetupCKS-00215 minutesSection B scored

Scenario

kubectl config use-context secure-prod
PodLabelsListens on
web-0app=webTCP 443
api-0app=apiTCP 8080
batch-0app=batchnone

edge is labeled zone=trusted-edge; approved clients are role=proxy. monitoring is labeled purpose=metrics; approved clients are role=scraper.

DNS Pods are in kube-system with k8s-app=kube-dns. Database CIDR is 10.40.0.0/16; 10.40.8.0/24 is forbidden. Future unlabeled Pods may appear in blue.

Required end state

  1. Default-deny ingress and egress for every current and future Pod in blue.
  2. Trusted edge proxies alone may reach web on TCP 443.
  3. Only web may reach api on TCP 8080.
  4. Approved monitoring scrapers may reach web and api on TCP 9100.
  5. Only web and api may query cluster DNS over UDP/TCP 53.
  6. Only api may reach the database CIDR on TCP 5432, excluding its reserved subnet.
  7. batch has no traffic; no other traffic is permitted.
  8. Do not modify existing objects or use CNI-specific policy kinds.