Skip to content
CKSCluster SetupSingle nodeMedium

NetworkPolicy: default deny both directions with DNS

Scenario cks-set-001 · about 9 minutes · 10 points · 9 grader checks

Lock a namespace down with a default-deny ingress and egress policy, keep cluster DNS working and open exactly one client-to-server path.

  • networkpolicy
  • default-deny
  • egress
  • dns
  • cluster-setup

What you will practise

  • Write a default-deny policy for ingress and egress
  • Allow DNS egress to kube-dns across namespaces
  • Open one path with a matching egress and ingress rule pair

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-set-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Namespace "np-lock" runs four Deployments: "web" (pod label app=web, a client), "db" (pod label app=db, nginx, Service "db" on port 80), "cache" (pod label app=cache, nginx, Service "cache" on port 80) and "intruder" (pod label app=intruder, a client). Today every pod can talk to every other pod and to anything outside the namespace. Lock the namespace down with NetworkPolicies: 1. "default-deny": selects every pod in "np-lock" and denies all ingress AND all egress traffic. 2. "allow-dns": allows every pod in "np-lock" egress to the cluster DNS pods (namespace kube-system, pod label k8s-app=kube-dns) on UDP and TCP port 53, and nothing else. 3. "web-allow-db": allows the app=web pods egress to the app=db pods on TCP port 80. 4. "db-allow-web": allows ingress to the app=db pods from the app=web pods on TCP port 80. Afterwards "web" must get an HTTP answer from the Service "db", while "intruder" must not reach "db" and "web" must not reach "cache".

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Cluster Setup
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
10
Grader checks
9
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 9 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Setup labs

CKSCluster SetupMedium

Block the cloud metadata endpoint with an egress policy

Protect node metadata by blocking pod egress to 169.254.169.254 while keeping in-cluster traffic and other egress open.

Single node · ~6 min · 7 points

  • networkpolicy
  • egress
  • ipblock
  • metadata
  • cluster-setup

goldenkube start cks-set-002

CKSCluster SetupMedium

Kubelet CIS hardening on a worker

A worker's kubelet accepts anonymous, unauthorized requests and exposes the read-only port; harden its configuration in place.

Two nodes · ~8 min · 8 points

  • kubelet
  • cis-benchmark
  • authentication
  • authorization
  • node

goldenkube start cks-set-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.