CKS_FINALE

2026-09-14 16:44:59 +06:00
commit c0da43e51f
57 changed files with 2331 additions and 0 deletions
--- a/submissions/CKS-001-attempt-1.md
+++ b/submissions/CKS-001-attempt-1.md
@@ -0,0 +1,197 @@
+# CKS-001 — NetworkPolicy containment under pressure
+
+Status: **Attempt 1 — awaiting learner answer**  
+Domain: **Cluster Setup (15%)**  
+Topic: **NetworkPolicy and metadata protection**  
+Target time: **12 minutes**  
+Difficulty: **Harder than CKS**
+
+## Scenario
+
+Use context:
+
+```bash
+kubectl config use-context prod-sec
+```
+
+Namespace `payments` already contains these Pods:
+
+| Pod | Labels |
+|---|---|
+| `api-0` | `app=api`, `tier=backend` |
+| `worker-0` | `app=worker`, `tier=backend` |
+| `debug-0` | `app=debug` |
+
+Namespace `gateway` has label `access=payments` and contains Pods labeled `app=ingress`.
+
+Namespace `observability` has label `team=monitoring` and contains Pods labeled `app=prometheus`.
+
+The cluster DNS Pods are in namespace `kube-system` with label `k8s-app=kube-dns`. The cloud instance-metadata endpoint is `169.254.169.254/32`.
+
+## Required end state
+
+Create one or more NetworkPolicies in namespace `payments` so that:
+
+1. Every Pod in `payments` is isolated for both ingress and egress.
+2. Only `gateway` Pods labeled `app=ingress` may connect to TCP port `8443` on Pods labeled `app=api`.
+3. Only `observability` Pods labeled `app=prometheus` may scrape TCP port `9090` on Pods labeled `tier=backend`.
+4. `api` and `worker` Pods may query cluster DNS using UDP and TCP port `53`; `debug-0` must have no egress, including DNS.
+5. Pods labeled `app=api` may make TCP connections to any IPv4 destination on port `443`, except `169.254.169.254/32`.
+6. No other ingress or egress is permitted.
+7. Do not modify Pods, namespaces, Services, or existing labels.
+
+Assume the installed CNI enforces Kubernetes `NetworkPolicy`. Do not use Cilium-specific resources.
+
+## Deliverables
+
+Write your proposed commands/manifests and verification plan below. Do not ask the teacher to apply them.
+
+### A. Context and pre-check commands
+
+```bash
+kubectl config use-context prod-sec
+k get pods -n payment
+k get pods -n payment -o wide
+k get pods -n payment --show-labels
+k get ns --show-labels
+k get pods -n gateway --show-labels
+k get pods -n observability --show-labels
+k get pods -n kube-system --show-labels
+```
+
+### B. NetworkPolicy manifest(s)
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: policy-for-gateway 
+  namespace: payments 
+spec:
+  podSelector:
+    matchLabels:
+      app: api
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          access: payments
+      podSelector:
+        matchLabels:
+          app: ingress
+    ports:
+    - protocol: TCP
+      port: 8443
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 169.254.169.254/32
+    ports:
+    - protocol: TCP
+      port: 443
+  - to:
+    - podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+      namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 53
+    - protocol: UDP
+      port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: policy-for-monitoring
+  namespace: payments 
+spec:
+  podSelector:
+    matchLabels:
+      tier: backend 
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          team: monitoring
+      podSelector:
+        matchLabels:
+          app: prometheus
+    ports:
+    - protocol: TCP
+      port: 9090
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+      namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 53
+    - protocol: UDP
+      port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: policy-for-debug
+  namespace: payments 
+spec:
+  podSelector:
+    matchLabels:
+      app: debug
+  policyTypes:
+  - Ingress
+  - Egress
+```
+
+### C. Verification commands and expected outcomes
+
+Show at least one positive and one negative test for every distinct rule. Tests must demonstrate that metadata access is denied and that `debug-0` has no DNS egress.
+
+```bash
+k apply -f np-payments.yaml
+k get networkpolicy -n payments
+POD=$(k get pod -n gateway -l app=ingress -o name)
+API_IP=$(k get pod api-0 -n payments -o jsonpath='{.status.podIP}')
+WORKER_IP=$(k get pod worker-0 -n payments -o jsonpath='{.status.podIP}')
+k exec -n gateway $POD -- telnet $API_IP 8443
+POD=$(k get pod -n observability -l app=prometheus -o name)
+k exec -n observability $POD -- telnet $WORKER_IP 9090
+```
+
+### D. Short reasoning
+
+Explain briefly why your selectors do not accidentally allow:
+
+- every Pod in an allowed namespace;
+- every port from an allowed source;
+- metadata access over a non-443 port;
+- DNS access from `debug-0`.
+
+Write here:
+
+> 
+
+## Submission
+
+- [ ] I checked the context.
+- [ ] I validated the YAML client-side or server-side.
+- [ ] I covered all seven required outcomes.
+- [ ] I included both allowed and denied verification cases.
+- [ ] I am ready for grading.
+
+When ready, save this file and tell the teacher: **Grade CKS-001 attempt 1**.