cks-final/submissions/CKS-001-attempt-1.md

# CKS-001 — NetworkPolicy containment under pressure

Status: **Attempt 1 — awaiting learner answer**  
Domain: **Cluster Setup (15%)**  
Topic: **NetworkPolicy and metadata protection**  
Target time: **12 minutes**  
Difficulty: **Harder than CKS**

## Scenario

Use context:

```bash
kubectl config use-context prod-sec
```

Namespace `payments` already contains these Pods:

| Pod | Labels |
|---|---|
| `api-0` | `app=api`, `tier=backend` |
| `worker-0` | `app=worker`, `tier=backend` |
| `debug-0` | `app=debug` |

Namespace `gateway` has label `access=payments` and contains Pods labeled `app=ingress`.

Namespace `observability` has label `team=monitoring` and contains Pods labeled `app=prometheus`.

The cluster DNS Pods are in namespace `kube-system` with label `k8s-app=kube-dns`. The cloud instance-metadata endpoint is `169.254.169.254/32`.

## Required end state

Create one or more NetworkPolicies in namespace `payments` so that:

1. Every Pod in `payments` is isolated for both ingress and egress.
2. Only `gateway` Pods labeled `app=ingress` may connect to TCP port `8443` on Pods labeled `app=api`.
3. Only `observability` Pods labeled `app=prometheus` may scrape TCP port `9090` on Pods labeled `tier=backend`.
4. `api` and `worker` Pods may query cluster DNS using UDP and TCP port `53`; `debug-0` must have no egress, including DNS.
5. Pods labeled `app=api` may make TCP connections to any IPv4 destination on port `443`, except `169.254.169.254/32`.
6. No other ingress or egress is permitted.
7. Do not modify Pods, namespaces, Services, or existing labels.

Assume the installed CNI enforces Kubernetes `NetworkPolicy`. Do not use Cilium-specific resources.

## Deliverables

Write your proposed commands/manifests and verification plan below. Do not ask the teacher to apply them.

### A. Context and pre-check commands

```bash
kubectl config use-context prod-sec
k get pods -n payment
k get pods -n payment -o wide
k get pods -n payment --show-labels
k get ns --show-labels
k get pods -n gateway --show-labels
k get pods -n observability --show-labels
k get pods -n kube-system --show-labels
```

### B. NetworkPolicy manifest(s)

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-for-gateway 
  namespace: payments 
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          access: payments
      podSelector:
        matchLabels:
          app: ingress
    ports:
    - protocol: TCP
      port: 8443
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
    ports:
    - protocol: TCP
      port: 443
  - to:
    - podSelector:
        matchLabels:
          k8s-app: kube-dns
      namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-for-monitoring
  namespace: payments 
spec:
  podSelector:
    matchLabels:
      tier: backend 
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          team: monitoring
      podSelector:
        matchLabels:
          app: prometheus
    ports:
    - protocol: TCP
      port: 9090
  egress:
  - to:
    - podSelector:
        matchLabels:
          k8s-app: kube-dns
      namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-for-debug
  namespace: payments 
spec:
  podSelector:
    matchLabels:
      app: debug
  policyTypes:
  - Ingress
  - Egress
```

### C. Verification commands and expected outcomes

Show at least one positive and one negative test for every distinct rule. Tests must demonstrate that metadata access is denied and that `debug-0` has no DNS egress.

```bash
k apply -f np-payments.yaml
k get networkpolicy -n payments
POD=$(k get pod -n gateway -l app=ingress -o name)
API_IP=$(k get pod api-0 -n payments -o jsonpath='{.status.podIP}')
WORKER_IP=$(k get pod worker-0 -n payments -o jsonpath='{.status.podIP}')
k exec -n gateway $POD -- telnet $API_IP 8443
POD=$(k get pod -n observability -l app=prometheus -o name)
k exec -n observability $POD -- telnet $WORKER_IP 9090
```

### D. Short reasoning

Explain briefly why your selectors do not accidentally allow:

- every Pod in an allowed namespace;
- every port from an allowed source;
- metadata access over a non-443 port;
- DNS access from `debug-0`.

Write here:

> 

## Submission

- [ ] I checked the context.
- [ ] I validated the YAML client-side or server-side.
- [ ] I covered all seven required outcomes.
- [ ] I included both allowed and denied verification cases.
- [ ] I am ready for grading.

When ready, save this file and tell the teacher: **Grade CKS-001 attempt 1**.