Cluster Setup
Cluster Setup in the CKS exam is about configuring the cluster's own defenses: network segmentation, ingress, API access, and baseline compliance. You must be comfortable writing NetworkPolicy objects from scratch, because the exam rarely hands you a template. Understand that a policy selects pods by label and then defines which peers may talk to them, and that ingress and egress are independent directions. A policy with podSelector: {}, policyTypes: [Ingress, Egress], and no rules is a namespace-wide default deny - a very common starting point. Once any policy selects a pod, traffic not explicitly allowed is denied in that direction, and DNS resolution needs an egress rule to port 53 or your default deny will break name resolution.
Also know how to run kube-bench for CIS Benchmark checks, create Ingress resources with TLS, and block access to node metadata such as 169.254.169.254 using an egress policy. Traps: omitting policyTypes (an ingress-only policy does not restrict egress), confusing namespaceSelector with podSelector, and assuming every CNI enforces NetworkPolicy - some do not. Rule of thumb: deny first, then add the smallest allow rule that makes the workload function.
Worked example: to allow frontend pods in namespace web to reach backend pods on TCP 8080, create a NetworkPolicy in the backend namespace with podSelector: matchLabels: app=backend, ingress from namespaceSelector: matchLabels: kubernetes.io/metadata.name=web plus podSelector: matchLabels: app=frontend, and ports 8080/TCP.