cks-final/submissions/CKS-002-skipped.md

CKS-002 — NetworkPolicy two-sided isolation

Status: Fresh mastery attempt — awaiting learner answer
Domain: Cluster Setup (15%)
Topic: NetworkPolicy and cluster-level network restriction
Target time: 15 minutes
Difficulty: Harder than CKS

Scenario

Use context:

kubectl config use-context secure-prod

Namespace blue contains:

Pod	Labels	Listens on
web-0	app=web	TCP 443
api-0	app=api	TCP 8080
batch-0	app=batch	none

Additional facts:

• Namespace edge has label zone=trusted-edge; its approved clients have label role=proxy.
• Namespace monitoring has label purpose=metrics; its approved clients have label role=scraper.
• Cluster DNS Pods are in kube-system with label k8s-app=kube-dns.
• The internal database range is 10.40.0.0/16, but subnet 10.40.8.0/24 is reserved and forbidden.
• Future unlabeled Pods may be added to namespace blue.

Required end state

Create Kubernetes NetworkPolicy resources in namespace blue so that:

1. Every current and future Pod in blue is default-denied for both ingress and egress.
2. Only role=proxy Pods from the zone=trusted-edge namespace may reach app=web on TCP 443.
3. Only app=web Pods in blue may reach app=api on TCP 8080.
4. Only role=scraper Pods from the purpose=metrics namespace may reach both web and api Pods on TCP 9100.
5. Only web and api Pods may query cluster DNS over both UDP and TCP 53.
6. Only api Pods may connect to 10.40.0.0/16 on TCP 5432, excluding 10.40.8.0/24.
7. batch Pods must have no ingress or egress. No other traffic is permitted.
8. Do not modify existing Pods, namespaces, labels, or Services. Use standard Kubernetes NetworkPolicy only.

Section B — scored implementation

Section B is the only scored section. Write all required manifests below.

# Replace this comment with your complete NetworkPolicy manifests.

Optional self-check — unscored

• An empty-selector policy covers future unlabeled Pods.
• Every cross-namespace peer requires the correct namespace and Pod labels together.
• The web → api:8080 path is permitted in both relevant policy directions.
• DNS does not become available to batch or future unlabeled Pods.
• The reserved database subnet remains unreachable.
• No rule accidentally opens all ports or all sources.

When ready, save this file and tell the teacher: Grade CKS-002 fresh attempt.