# CKS-002 — NetworkPolicy two-sided isolation

Status: **Fresh mastery attempt — awaiting learner answer**  
Domain: **Cluster Setup (15%)**  
Topic: **NetworkPolicy and cluster-level network restriction**  
Target time: **15 minutes**  
Difficulty: **Harder than CKS**

## Scenario

Use context:

```bash
kubectl config use-context secure-prod
```

Namespace `blue` contains:

| Pod | Labels | Listens on |
|---|---|---|
| `web-0` | `app=web` | TCP `443` |
| `api-0` | `app=api` | TCP `8080` |
| `batch-0` | `app=batch` | none |

Additional facts:

- Namespace `edge` has label `zone=trusted-edge`; its approved clients have label `role=proxy`.
- Namespace `monitoring` has label `purpose=metrics`; its approved clients have label `role=scraper`.
- Cluster DNS Pods are in `kube-system` with label `k8s-app=kube-dns`.
- The internal database range is `10.40.0.0/16`, but subnet `10.40.8.0/24` is reserved and forbidden.
- Future unlabeled Pods may be added to namespace `blue`.

## Required end state

Create Kubernetes `NetworkPolicy` resources in namespace `blue` so that:

1. Every current and future Pod in `blue` is default-denied for both ingress and egress.
2. Only `role=proxy` Pods from the `zone=trusted-edge` namespace may reach `app=web` on TCP `443`.
3. Only `app=web` Pods in `blue` may reach `app=api` on TCP `8080`.
4. Only `role=scraper` Pods from the `purpose=metrics` namespace may reach both `web` and `api` Pods on TCP `9100`.
5. Only `web` and `api` Pods may query cluster DNS over both UDP and TCP `53`.
6. Only `api` Pods may connect to `10.40.0.0/16` on TCP `5432`, excluding `10.40.8.0/24`.
7. `batch` Pods must have no ingress or egress. No other traffic is permitted.
8. Do not modify existing Pods, namespaces, labels, or Services. Use standard Kubernetes `NetworkPolicy` only.

## Section B — scored implementation

Section B is the only scored section. Write all required manifests below.

```yaml
# Replace this comment with your complete NetworkPolicy manifests.
```

## Optional self-check — unscored

- [ ] An empty-selector policy covers future unlabeled Pods.
- [ ] Every cross-namespace peer requires the correct namespace and Pod labels together.
- [ ] The `web → api:8080` path is permitted in both relevant policy directions.
- [ ] DNS does not become available to `batch` or future unlabeled Pods.
- [ ] The reserved database subnet remains unreachable.
- [ ] No rule accidentally opens all ports or all sources.

When ready, save this file and tell the teacher: **Grade CKS-002 fresh attempt**.