90 lines
5.1 KiB
HTML
90 lines
5.1 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="description" content="A hard, hands-on CKS NetworkPolicy mastery question.">
|
|
<title>CKS-001 · NetworkPolicy Containment</title>
|
|
<link rel="stylesheet" href="../assets/course.css">
|
|
</head>
|
|
<body>
|
|
<main class="page">
|
|
<header class="hero">
|
|
<p class="eyebrow">CKS mastery journey · Question 001</p>
|
|
<h1>NetworkPolicy containment under pressure</h1>
|
|
<p class="deck">Build a precise default-deny posture, preserve only required flows, and prove that the cloud metadata endpoint remains unreachable.</p>
|
|
<div class="meta" aria-label="Question metadata">
|
|
<span class="pill">Cluster Setup</span>
|
|
<span class="pill">Attempt 1</span>
|
|
<span class="pill">12 minutes</span>
|
|
<span class="pill">Harder than CKS</span>
|
|
</div>
|
|
</header>
|
|
|
|
<div class="layout">
|
|
<div>
|
|
<section class="card" aria-labelledby="scenario">
|
|
<h2 id="scenario">Scenario</h2>
|
|
<p>Begin by selecting the designated cluster:</p>
|
|
<pre><code>kubectl config use-context prod-sec</code></pre>
|
|
<p>Namespace <code>payments</code> already contains these Pods:</p>
|
|
<table>
|
|
<thead><tr><th>Pod</th><th>Labels</th></tr></thead>
|
|
<tbody>
|
|
<tr><td><code>api-0</code></td><td><code>app=api</code>, <code>tier=backend</code></td></tr>
|
|
<tr><td><code>worker-0</code></td><td><code>app=worker</code>, <code>tier=backend</code></td></tr>
|
|
<tr><td><code>debug-0</code></td><td><code>app=debug</code></td></tr>
|
|
</tbody>
|
|
</table>
|
|
<p>Namespace <code>gateway</code> has label <code>access=payments</code> and contains Pods labeled <code>app=ingress</code>.</p>
|
|
<p>Namespace <code>observability</code> has label <code>team=monitoring</code> and contains Pods labeled <code>app=prometheus</code>.</p>
|
|
<p>The cluster DNS Pods are in <code>kube-system</code> with label <code>k8s-app=kube-dns</code>. The cloud instance-metadata endpoint is <code>169.254.169.254/32</code>.</p>
|
|
</section>
|
|
|
|
<section class="card" aria-labelledby="outcome">
|
|
<h2 id="outcome">Required end state</h2>
|
|
<ol class="requirements">
|
|
<li>Every Pod in <code>payments</code> is isolated for both ingress and egress.</li>
|
|
<li>Only <code>gateway</code> Pods labeled <code>app=ingress</code> may connect to TCP port <code>8443</code> on Pods labeled <code>app=api</code>.</li>
|
|
<li>Only <code>observability</code> Pods labeled <code>app=prometheus</code> may scrape TCP port <code>9090</code> on Pods labeled <code>tier=backend</code>.</li>
|
|
<li><code>api</code> and <code>worker</code> Pods may query cluster DNS over UDP and TCP port <code>53</code>; <code>debug-0</code> must have no egress, including DNS.</li>
|
|
<li>Pods labeled <code>app=api</code> may make TCP connections to any IPv4 destination on port <code>443</code>, except <code>169.254.169.254/32</code>.</li>
|
|
<li>No other ingress or egress is permitted.</li>
|
|
<li>Do not modify Pods, namespaces, Services, or existing labels.</li>
|
|
</ol>
|
|
<div class="note"><strong>Environment:</strong> Assume the installed CNI enforces Kubernetes <code>NetworkPolicy</code>. Do not use Cilium-specific resources.</div>
|
|
</section>
|
|
|
|
<section class="card" aria-labelledby="deliverables">
|
|
<h2 id="deliverables">Your deliverables</h2>
|
|
<h3>A · Context and pre-checks</h3>
|
|
<p>Record the commands you would use to confirm the context, labels, Pods, namespaces, and existing policy state.</p>
|
|
<h3>B · Complete manifest set</h3>
|
|
<p>Provide every NetworkPolicy needed to achieve the required end state.</p>
|
|
<h3>C · Verification evidence</h3>
|
|
<p>Include at least one positive and one negative test for each distinct rule. Explicitly prove that metadata access is denied and <code>debug-0</code> cannot use DNS.</p>
|
|
<h3>D · Selector reasoning</h3>
|
|
<p>Explain why the policies do not accidentally allow every Pod in an approved namespace, every port from an approved source, metadata on another port, or DNS from <code>debug-0</code>.</p>
|
|
</section>
|
|
</div>
|
|
|
|
<aside class="rail card" aria-labelledby="journey">
|
|
<p class="eyebrow">Mastery loop</p>
|
|
<h2 id="journey">Your journey</h2>
|
|
<ol class="steps">
|
|
<li class="active">Solve CKS-001</li>
|
|
<li>Submit attempt</li>
|
|
<li>Repair one mistake</li>
|
|
<li>Earn a score</li>
|
|
<li>Pass fresh transfer task</li>
|
|
</ol>
|
|
<a class="button" href="../ANSWER.md">Open answer file</a>
|
|
<p class="small">Edit only the Markdown answer file. This page remains your clean question sheet.</p>
|
|
</aside>
|
|
</div>
|
|
|
|
<footer>CKS Mastery Journey · Ask your teacher about anything unclear, but remember: hints become stronger gradually.</footer>
|
|
</main>
|
|
</body>
|
|
</html>
|