cks-final/submissions/CKS-001-attempt-1.md

CKS-001 — NetworkPolicy containment under pressure

Status: Attempt 1 — awaiting learner answer
Domain: Cluster Setup (15%)
Topic: NetworkPolicy and metadata protection
Target time: 12 minutes
Difficulty: Harder than CKS

Scenario

Use context:

kubectl config use-context prod-sec

Namespace payments already contains these Pods:

Pod	Labels
api-0	app=api, tier=backend
worker-0	app=worker, tier=backend
debug-0	app=debug

Namespace gateway has label access=payments and contains Pods labeled app=ingress.

Namespace observability has label team=monitoring and contains Pods labeled app=prometheus.

The cluster DNS Pods are in namespace kube-system with label k8s-app=kube-dns. The cloud instance-metadata endpoint is 169.254.169.254/32.

Required end state

Create one or more NetworkPolicies in namespace payments so that:

1. Every Pod in payments is isolated for both ingress and egress.
2. Only gateway Pods labeled app=ingress may connect to TCP port 8443 on Pods labeled app=api.
3. Only observability Pods labeled app=prometheus may scrape TCP port 9090 on Pods labeled tier=backend.
4. api and worker Pods may query cluster DNS using UDP and TCP port 53; debug-0 must have no egress, including DNS.
5. Pods labeled app=api may make TCP connections to any IPv4 destination on port 443, except 169.254.169.254/32.
6. No other ingress or egress is permitted.
7. Do not modify Pods, namespaces, Services, or existing labels.

Assume the installed CNI enforces Kubernetes NetworkPolicy. Do not use Cilium-specific resources.

Deliverables

Write your proposed commands/manifests and verification plan below. Do not ask the teacher to apply them.

A. Context and pre-check commands

kubectl config use-context prod-sec
k get pods -n payment
k get pods -n payment -o wide
k get pods -n payment --show-labels
k get ns --show-labels
k get pods -n gateway --show-labels
k get pods -n observability --show-labels
k get pods -n kube-system --show-labels

B. NetworkPolicy manifest(s)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-for-gateway 
  namespace: payments 
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          access: payments
      podSelector:
        matchLabels:
          app: ingress
    ports:
    - protocol: TCP
      port: 8443
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
    ports:
    - protocol: TCP
      port: 443
  - to:
    - podSelector:
        matchLabels:
          k8s-app: kube-dns
      namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-for-monitoring
  namespace: payments 
spec:
  podSelector:
    matchLabels:
      tier: backend 
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          team: monitoring
      podSelector:
        matchLabels:
          app: prometheus
    ports:
    - protocol: TCP
      port: 9090
  egress:
  - to:
    - podSelector:
        matchLabels:
          k8s-app: kube-dns
      namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-for-debug
  namespace: payments 
spec:
  podSelector:
    matchLabels:
      app: debug
  policyTypes:
  - Ingress
  - Egress

C. Verification commands and expected outcomes

Show at least one positive and one negative test for every distinct rule. Tests must demonstrate that metadata access is denied and that debug-0 has no DNS egress.

k apply -f np-payments.yaml
k get networkpolicy -n payments
POD=$(k get pod -n gateway -l app=ingress -o name)
API_IP=$(k get pod api-0 -n payments -o jsonpath='{.status.podIP}')
WORKER_IP=$(k get pod worker-0 -n payments -o jsonpath='{.status.podIP}')
k exec -n gateway $POD -- telnet $API_IP 8443
POD=$(k get pod -n observability -l app=prometheus -o name)
k exec -n observability $POD -- telnet $WORKER_IP 9090

D. Short reasoning

Explain briefly why your selectors do not accidentally allow:

• every Pod in an allowed namespace;
• every port from an allowed source;
• metadata access over a non-443 port;
• DNS access from debug-0.

Write here:

Submission

• I checked the context.
• I validated the YAML client-side or server-side.
• I covered all seven required outcomes.
• I included both allowed and denied verification cases.
• I am ready for grading.

When ready, save this file and tell the teacher: Grade CKS-001 attempt 1.