CKS_FINALE

submissions/CKS-002-skipped.md

@@ -0,0 +1,63 @@
+# CKS-002 — NetworkPolicy two-sided isolation
+
+Status: **Fresh mastery attempt — awaiting learner answer**  
+Domain: **Cluster Setup (15%)**  
+Topic: **NetworkPolicy and cluster-level network restriction**  
+Target time: **15 minutes**  
+Difficulty: **Harder than CKS**
+
+## Scenario
+
+Use context:
+
+```bash
+kubectl config use-context secure-prod
+```
+
+Namespace `blue` contains:
+
+| Pod | Labels | Listens on |
+|---|---|---|
+| `web-0` | `app=web` | TCP `443` |
+| `api-0` | `app=api` | TCP `8080` |
+| `batch-0` | `app=batch` | none |
+
+Additional facts:
+
+- Namespace `edge` has label `zone=trusted-edge`; its approved clients have label `role=proxy`.
+- Namespace `monitoring` has label `purpose=metrics`; its approved clients have label `role=scraper`.
+- Cluster DNS Pods are in `kube-system` with label `k8s-app=kube-dns`.
+- The internal database range is `10.40.0.0/16`, but subnet `10.40.8.0/24` is reserved and forbidden.
+- Future unlabeled Pods may be added to namespace `blue`.
+
+## Required end state
+
+Create Kubernetes `NetworkPolicy` resources in namespace `blue` so that:
+
+1. Every current and future Pod in `blue` is default-denied for both ingress and egress.
+2. Only `role=proxy` Pods from the `zone=trusted-edge` namespace may reach `app=web` on TCP `443`.
+3. Only `app=web` Pods in `blue` may reach `app=api` on TCP `8080`.
+4. Only `role=scraper` Pods from the `purpose=metrics` namespace may reach both `web` and `api` Pods on TCP `9100`.
+5. Only `web` and `api` Pods may query cluster DNS over both UDP and TCP `53`.
+6. Only `api` Pods may connect to `10.40.0.0/16` on TCP `5432`, excluding `10.40.8.0/24`.
+7. `batch` Pods must have no ingress or egress. No other traffic is permitted.
+8. Do not modify existing Pods, namespaces, labels, or Services. Use standard Kubernetes `NetworkPolicy` only.
+
+## Section B — scored implementation
+
+Section B is the only scored section. Write all required manifests below.
+
+```yaml
+# Replace this comment with your complete NetworkPolicy manifests.
+```
+
+## Optional self-check — unscored
+
+- [ ] An empty-selector policy covers future unlabeled Pods.
+- [ ] Every cross-namespace peer requires the correct namespace and Pod labels together.
+- [ ] The `web → api:8080` path is permitted in both relevant policy directions.
+- [ ] DNS does not become available to `batch` or future unlabeled Pods.
+- [ ] The reserved database subnet remains unreachable.
+- [ ] No rule accidentally opens all ports or all sources.
+
+When ready, save this file and tell the teacher: **Grade CKS-002 fresh attempt**.