CKS mastery journey · Question 001

NetworkPolicy containment under pressure

Build a precise default-deny posture, preserve only required flows, and prove that the cloud metadata endpoint remains unreachable.

Cluster Setup Attempt 1 12 minutes Harder than CKS

Scenario

Begin by selecting the designated cluster:

kubectl config use-context prod-sec

Namespace payments already contains these Pods:

Pod	Labels
`api-0`	`app=api`, `tier=backend`
`worker-0`	`app=worker`, `tier=backend`
`debug-0`	`app=debug`

Namespace gateway has label access=payments and contains Pods labeled app=ingress.

Namespace observability has label team=monitoring and contains Pods labeled app=prometheus.

The cluster DNS Pods are in kube-system with label k8s-app=kube-dns. The cloud instance-metadata endpoint is 169.254.169.254/32.

Required end state

Every Pod in payments is isolated for both ingress and egress.
Only gateway Pods labeled app=ingress may connect to TCP port 8443 on Pods labeled app=api.
Only observability Pods labeled app=prometheus may scrape TCP port 9090 on Pods labeled tier=backend.
api and worker Pods may query cluster DNS over UDP and TCP port 53; debug-0 must have no egress, including DNS.
Pods labeled app=api may make TCP connections to any IPv4 destination on port 443, except 169.254.169.254/32.
No other ingress or egress is permitted.
Do not modify Pods, namespaces, Services, or existing labels.

Environment: Assume the installed CNI enforces Kubernetes NetworkPolicy. Do not use Cilium-specific resources.

Your deliverables

A · Context and pre-checks

Record the commands you would use to confirm the context, labels, Pods, namespaces, and existing policy state.

B · Complete manifest set

Provide every NetworkPolicy needed to achieve the required end state.

C · Verification evidence

Include at least one positive and one negative test for each distinct rule. Explicitly prove that metadata access is denied and debug-0 cannot use DNS.

D · Selector reasoning

Explain why the policies do not accidentally allow every Pod in an approved namespace, every port from an approved source, metadata on another port, or DNS from debug-0.