55 lines
3.3 KiB
HTML
55 lines
3.3 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="description" content="A harder-than-CKS NetworkPolicy transfer question.">
|
|
<title>CKS-002 · Two-Sided Isolation</title>
|
|
<link rel="stylesheet" href="../assets/course.css">
|
|
</head>
|
|
<body>
|
|
<main class="page">
|
|
<header class="hero">
|
|
<p class="eyebrow">CKS mastery journey · Fresh transfer</p>
|
|
<h1>Two-sided NetworkPolicy isolation</h1>
|
|
<p class="deck">Secure current and future workloads while composing namespace, Pod, port, DNS, and CIDR restrictions without unintended additive access.</p>
|
|
<div class="meta"><span class="pill">Cluster Setup</span><span class="pill">CKS-002</span><span class="pill">15 minutes</span><span class="pill">Section B scored</span></div>
|
|
</header>
|
|
<div class="layout">
|
|
<div>
|
|
<section class="card">
|
|
<h2>Scenario</h2>
|
|
<pre><code>kubectl config use-context secure-prod</code></pre>
|
|
<table>
|
|
<thead><tr><th>Pod</th><th>Labels</th><th>Listens on</th></tr></thead>
|
|
<tbody><tr><td><code>web-0</code></td><td><code>app=web</code></td><td>TCP 443</td></tr><tr><td><code>api-0</code></td><td><code>app=api</code></td><td>TCP 8080</td></tr><tr><td><code>batch-0</code></td><td><code>app=batch</code></td><td>none</td></tr></tbody>
|
|
</table>
|
|
<p><code>edge</code> is labeled <code>zone=trusted-edge</code>; approved clients are <code>role=proxy</code>. <code>monitoring</code> is labeled <code>purpose=metrics</code>; approved clients are <code>role=scraper</code>.</p>
|
|
<p>DNS Pods are in <code>kube-system</code> with <code>k8s-app=kube-dns</code>. Database CIDR is <code>10.40.0.0/16</code>; <code>10.40.8.0/24</code> is forbidden. Future unlabeled Pods may appear in <code>blue</code>.</p>
|
|
</section>
|
|
<section class="card">
|
|
<h2>Required end state</h2>
|
|
<ol class="requirements">
|
|
<li>Default-deny ingress and egress for every current and future Pod in <code>blue</code>.</li>
|
|
<li>Trusted edge proxies alone may reach <code>web</code> on TCP 443.</li>
|
|
<li>Only <code>web</code> may reach <code>api</code> on TCP 8080.</li>
|
|
<li>Approved monitoring scrapers may reach <code>web</code> and <code>api</code> on TCP 9100.</li>
|
|
<li>Only <code>web</code> and <code>api</code> may query cluster DNS over UDP/TCP 53.</li>
|
|
<li>Only <code>api</code> may reach the database CIDR on TCP 5432, excluding its reserved subnet.</li>
|
|
<li><code>batch</code> has no traffic; no other traffic is permitted.</li>
|
|
<li>Do not modify existing objects or use CNI-specific policy kinds.</li>
|
|
</ol>
|
|
</section>
|
|
</div>
|
|
<aside class="rail card">
|
|
<p class="eyebrow">Mastery gate</p><h2>One clean attempt</h2>
|
|
<ol class="steps"><li class="active">Write Section B</li><li>Submit once</li><li>Score implementation</li><li>Unlock or remediate</li></ol>
|
|
<a class="button" href="../ANSWER.md">Open answer file</a>
|
|
<p class="small">Only your manifests are scored. The checklist is a private self-check.</p>
|
|
</aside>
|
|
</div>
|
|
<footer>CKS Mastery Journey · Question 002</footer>
|
|
</main>
|
|
</body>
|
|
</html>
|