Skip to content
CNPEPlatform Architecture and InfrastructureSingle nodeMedium

Storage and network baseline: a Retain default class and default-deny

Scenario cnpe-arc-003 · about 15 minutes · 10 points · 7 grader checks

Tenant data must survive claim deletion and tenants must be isolated by default. Make a Retain StorageClass the only default, bind the ledger claim to it and lock the namespace down.

  • storageclass
  • persistentvolumeclaim
  • reclaim-policy
  • networkpolicy
  • default-deny
  • platform-architecture

What you will practise

  • Create a StorageClass with reclaimPolicy Retain and WaitForFirstConsumer binding
  • Switch the cluster default StorageClass
  • Apply a default-deny NetworkPolicy with a DNS exception

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cnpe-arc-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

The local-path provisioner (provisioner name rancher.io/local-path) backs the StorageClass "local-path", which is currently the cluster default. 1. Create a StorageClass "retained" with the same provisioner, reclaimPolicy Retain and volumeBindingMode WaitForFirstConsumer, and make it the only default StorageClass of the cluster. 2. In namespace "ledger" create a PersistentVolumeClaim "data" (ReadWriteOnce, 1Gi) that gets its class from the cluster default. The Deployment "ledger" already mounts a claim of that name; it must become Ready with the volume Bound. 3. In "ledger" create a NetworkPolicy "default-deny" that denies all ingress and all egress for every pod, and a NetworkPolicy "allow-dns" that lets every pod in "ledger" reach DNS (UDP and TCP 53) in namespace kube-system only.

Requirements and details

Certification
CNPE · Certified Cloud Native Platform Engineer
Domain
Platform Architecture and Infrastructure
Difficulty
Medium
Cluster topology
Single node
Cluster features
Storage
Recommended time
15 minutes
Points
10
Grader checks
7
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 7 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Platform Architecture and Infrastructure labs

CNPEPlatform Architecture and InfrastructureMedium

Multi-tenancy: quotas, defaults, priority and a tenant node pool

Two teams share one cluster. Give each namespace a ResourceQuota and LimitRange, add a tenant PriorityClass and pin a tenant workload to a dedicated node pool.

Two nodes · ~15 min · 11 points

  • multi-tenancy
  • resourcequota
  • limitrange
  • priorityclass
  • node-affinity
  • platform-architecture

goldenkube start cnpe-arc-001

CNPEPlatform Architecture and InfrastructureMedium

Cost management: OpenCost custom pricing, right-sizing and an HPA

OpenCost runs with list prices and the catalog service reserves far more than it uses. Load the on-prem price sheet into OpenCost, right-size the workload and let an HPA scale it.

Single node · ~15 min · 11 points

  • opencost
  • cost-management
  • right-sizing
  • hpa
  • helm
  • platform-architecture

goldenkube start cnpe-arc-002

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.