64 lines
2.5 KiB
Markdown
64 lines
2.5 KiB
Markdown
# CKS-002 — NetworkPolicy two-sided isolation
|
|
|
|
Status: **Fresh mastery attempt — awaiting learner answer**
|
|
Domain: **Cluster Setup (15%)**
|
|
Topic: **NetworkPolicy and cluster-level network restriction**
|
|
Target time: **15 minutes**
|
|
Difficulty: **Harder than CKS**
|
|
|
|
## Scenario
|
|
|
|
Use context:
|
|
|
|
```bash
|
|
kubectl config use-context secure-prod
|
|
```
|
|
|
|
Namespace `blue` contains:
|
|
|
|
| Pod | Labels | Listens on |
|
|
|---|---|---|
|
|
| `web-0` | `app=web` | TCP `443` |
|
|
| `api-0` | `app=api` | TCP `8080` |
|
|
| `batch-0` | `app=batch` | none |
|
|
|
|
Additional facts:
|
|
|
|
- Namespace `edge` has label `zone=trusted-edge`; its approved clients have label `role=proxy`.
|
|
- Namespace `monitoring` has label `purpose=metrics`; its approved clients have label `role=scraper`.
|
|
- Cluster DNS Pods are in `kube-system` with label `k8s-app=kube-dns`.
|
|
- The internal database range is `10.40.0.0/16`, but subnet `10.40.8.0/24` is reserved and forbidden.
|
|
- Future unlabeled Pods may be added to namespace `blue`.
|
|
|
|
## Required end state
|
|
|
|
Create Kubernetes `NetworkPolicy` resources in namespace `blue` so that:
|
|
|
|
1. Every current and future Pod in `blue` is default-denied for both ingress and egress.
|
|
2. Only `role=proxy` Pods from the `zone=trusted-edge` namespace may reach `app=web` on TCP `443`.
|
|
3. Only `app=web` Pods in `blue` may reach `app=api` on TCP `8080`.
|
|
4. Only `role=scraper` Pods from the `purpose=metrics` namespace may reach both `web` and `api` Pods on TCP `9100`.
|
|
5. Only `web` and `api` Pods may query cluster DNS over both UDP and TCP `53`.
|
|
6. Only `api` Pods may connect to `10.40.0.0/16` on TCP `5432`, excluding `10.40.8.0/24`.
|
|
7. `batch` Pods must have no ingress or egress. No other traffic is permitted.
|
|
8. Do not modify existing Pods, namespaces, labels, or Services. Use standard Kubernetes `NetworkPolicy` only.
|
|
|
|
## Section B — scored implementation
|
|
|
|
Section B is the only scored section. Write all required manifests below.
|
|
|
|
```yaml
|
|
# Replace this comment with your complete NetworkPolicy manifests.
|
|
```
|
|
|
|
## Optional self-check — unscored
|
|
|
|
- [ ] An empty-selector policy covers future unlabeled Pods.
|
|
- [ ] Every cross-namespace peer requires the correct namespace and Pod labels together.
|
|
- [ ] The `web → api:8080` path is permitted in both relevant policy directions.
|
|
- [ ] DNS does not become available to `batch` or future unlabeled Pods.
|
|
- [ ] The reserved database subnet remains unreachable.
|
|
- [ ] No rule accidentally opens all ports or all sources.
|
|
|
|
When ready, save this file and tell the teacher: **Grade CKS-002 fresh attempt**.
|