Install Calico and prove NetworkPolicy enforcement (CKA Services & Networking)
A CKA Services & Networking walkthrough: the exam offers flannel or Calico, but 'must support NetworkPolicy enforcement' eliminates flannel. Install Calico with the Tigera operator manifests (kubectl create, not apply), match the ipPool cidr to the cluster pod CIDR, watch tigerastatus go Available, prove cross-node pod connectivity, then prove a default-deny NetworkPolicy blocks the same ping, with real terminal output.


