Linux Foundation Kubernetes System Administration CKS Questions & Answers

• Question 1:

  Create a Pod name Nginx-pod inside the namespace testing, Create a service for the Nginx-pod named nginx-svc, using the ingress of your choice, run the ingress on tls, secure port.

  A. See explanation below.

  B. PlaceHolder

  Correct Answer: A

  $ kubectl get ing -n NAME HOSTS ADDRESS PORTS AGE cafe-ingress cafe.com 10.0.2.15 80 25s

  $ kubectl describe ing -n Name: cafe-ingress Namespace: default Address: 10.0.2.15 Default backend: default-http-backend:80 (172.17.0.5:8080) Rules: Host Path Backends

  cafe.com

  /tea tea-svc:80 ()

  /coffee coffee-svc:80 ()

  Annotations:

  kubectl.kubernetes.io/last-applied-configuration:

  {"apiVersion":"networking.k8s.io/v1","kind":"Ingress","metadata":{"annotations":{},"name":"c afe-ingress","namespace":"default","selfLink":"/apis/networking/v1/namespaces/default/ingress es/cafe-ingress"},"spec":{"rules":

  [{"host":"cafe.com","http":{"paths":[{"backend":{"serviceName":"tea- svc","servicePort":80},"path":"/tea"},{"backend":{"serviceName":"coffee- svc","servicePort":80},"path":"/coffee"}]}}]},"status":{"loadBalancer":{"ingress":

  [{"ip":"169.48.142.110"}]}}}

  Events:

  Type Reason Age From Message

  Normal CREATE 1m ingress-nginx-controller Ingress default/cafe-ingress Normal UPDATE 58s ingress-nginx-controller Ingress default/cafe-ingress $ kubectl get pods -n NAME READY STATUS RESTARTS AGE ingress-nginx-controller-67956bf89d-fv58j 1/1 Running 0 1m

  $ kubectl logs -n ingress-nginx-controller-67956bf89d-fv58j ---------------------------------------------------------------------------------------------------- NGINX Ingress controller Release: 0.14.0 Build: git-734361d Repository: https://github.com/kubernetes/ingress-nginx

• Question 2:

  Create a new ServiceAccount named backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default.

  Create a new Pod named backend-pod in the namespace default, mount the newly created sa backend-sa to the pod, and Verify that the pod is able to list pods.

  Ensure that the Pod is running.

  A. See the below:

  B. PlaceHolder

  Correct Answer: A

  A service account provides an identity for processes that run in a Pod.

  When you (a human) access the cluster (for example, using kubectl), you are authenticated by the apiserver as a particular User Account (currently this is usually admin, unless your cluster administrator has customized your cluster). Processes in containers inside pods can also contact the apiserver. When they do, they are authenticated as a particular Service Account (for example, default).

  When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace. If you get the raw json or yaml for a pod you have created (for example, kubectl get pods/ -o yaml), you can see the spec.serviceAccountName field has been automatically set. You can access the API from inside a pod using automatically mounted service account credentials, as described in Accessing the Cluster. The API permissions of the service account depend on the authorization plugin and policy in use. In version 1.6+, you can opt out of automounting API credentials for a service account by setting automountServiceAccountToken: false on the service account:

  apiVersion: v1 kind: ServiceAccount metadata: name: build-robot automountServiceAccountToken: false

  In version 1.6+, you can also opt out of automounting API credentials for a particular pod: apiVersion: v1 kind: Pod metadata: name: my-pod spec: serviceAccountName: build-robot automountServiceAccountToken: false

  The pod spec takes precedence over the service account if both specify a automountServiceAccountToken value.

• Question 3:

  Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.

  Ensure that Network Policy:

  1.

  Does not allow access to pod not listening on port 80.

  2.

  Does not allow access from Pods, not in namespace staging.

  A. See the explanation below:

  B. PlaceHolder

  Correct Answer: A

  apiVersion: networking.k8s.io/v1

  kind: NetworkPolicy

  metadata:

  name: network-policy

  spec:

  podSelector: {} #selects all the pods in the namespace deployed policyTypes:

  -Ingress ingress:

  -ports: #in input traffic allowed only through 80 port only

  -protocol: TCP port: 80

• Question 4:

  Task Analyze and edit the given Dockerfile /home/candidate/KSSC00301/Docker file (based on the ubuntu:16.04 image), fixing two instructions present in the file that are prominent security/best-practice issues. Analyze and edit the given manifest file /home/candidate/KSSC00301/deployment.yaml, fixing two fields present in the file that are prominent security/best-practice issues.

  

  

  A. See explanation below.

  B. PlaceHolder

  Correct Answer: A

• Question 5:

  

  

  On the Cluster worker node, enforce the prepared AppArmor profile

  1.

  #include

  2.

  profile nginx-deny flags=(attach_disconnected) {

  3.

  #include

  4.

  file,

  5.

  # Deny all file writes.

  6.

  deny /** w,

  7.

  }

  8.

  EOF'

  Edit the prepared manifest file to include the AppArmor profile.

  1.

  apiVersion: v1

  2.

  kind: Pod

  3.

  metadata:

  4.

  name: apparmor-pod

  5.

  spec:

  6.

  containers:

  7.

  - name: apparmor-pod

  8.

  image: nginx

  Finally, apply the manifests files and create the Pod specified on it.

  Verify: Try to make a file inside the directory which is restricted.

  A. See explanation below.

  B. PlaceHolder

  Correct Answer: A

• Question 6:

  

  Fix all issues via configuration and restart the affected components to ensure the new setting takes effect. Fix all of the following violations that were found against the API server:

  1.

  Ensure that the RotateKubeletServerCertificate argument is set to true.

  2.

  Ensure that the admission control plugin PodSecurityPolicy is set.

  3.

  Ensure that the --kubelet-certificate-authority argument is set as appropriate. Fix all of the following violations that were found against the Kubelet:

  1.

  Ensure the --anonymous-auth argument is set to false.

  2.

  Ensure that the --authorization-mode argument is set to Webhook. Fix all of the following violations that were found against the ETCD:

  1.

  Ensure that the --auto-tls argument is not set to true

  2.

  Ensure that the --peer-auto-tls argument is not set to true

  Hint: Take the use of Tool Kube-Bench

  A. See the below.

  B. PlaceHolder

  Correct Answer: A

  Fix all of the following violations that were found against the API server:

  a. Ensure that the RotateKubeletServerCertificate argument is set to true.

  apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers:

  -command:

  -kube-controller-manager + - --feature-gates=RotateKubeletServerCertificate=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts:

  -

  mountPath: /etc/kubernetes/ name: k8s readOnly: true

  -

  mountPath: /etc/ssl/certs name: certs

  -

  mountPath: /etc/pki name: pki hostNetwork: true volumes:

  -

  hostPath: path: /etc/kubernetes name: k8s

  -

  hostPath: path: /etc/ssl/certs name: certs

  -

  hostPath: path: /etc/pki name: pki

  b.

  Ensure that the admission control plugin PodSecurityPolicy is set.

  audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"

  tests:

  test_items:

  -flag: "--enable-admission-plugins"

  compare:

  op: has

  value: "PodSecurityPolicy"

  set: true

  remediation: |

  Follow the documentation and create Pod Security Policy objects as per your environment.

  Then, edit the API server pod specification file $apiserverconf

  on the master node and set the --enable-admission-plugins parameter to a

  value that includes PodSecurityPolicy :

  --enable-admission-plugins=...,PodSecurityPolicy,...

  Then restart the API Server.

  scored: true

  c. Ensure that the --kubelet-certificate-authority argument is set as appropriate. audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"

  tests: test_items:

  -flag: "--kubelet-certificate-authority"

  set: true

  remediation: |

  Follow the Kubernetes documentation and setup the TLS connection between the

  apiserver and kubelets. Then, edit the API server pod specification file

  $apiserverconf on the master node and set the --kubelet-certificate-authority

  parameter to the path to the cert file for the certificate authority.

  --kubelet-certificate-authority=

  scored: true

  Fix all of the following violations that were found against the ETCD:

  a.

  Ensure that the --auto-tls argument is not set to true Edit the etcd pod specification file $etcdconf on the masternode and either remove the -- auto-tls parameter or set it to false.--auto-tls=false

  b.

  Ensure that the --peer-auto-tls argument is not set to true

  Edit the etcd pod specification file $etcdconf on the masternode and either remove the -- peer-auto-tls parameter or set it to false.--peer-auto-tls=false

• Question 7:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context dev

  A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

  Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress

  The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.

  Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.

  You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml

  A. See the explanation below

  B. PlaceHolder

  Correct Answer: A

  master1 $ k get pods -n test --show-labels uk.co.certification.simulator.questionpool.PList@132b47c0 $ vim netpol.yaml uk.co.certification.simulator.questionpool.PList@132b4af0 master1 $ k apply -f netpol.yaml

  controlplane $ k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing master1 $ vim netpol1.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-network namespace: test spec: podSelector: {} policyTypes:

  -Ingress

  -Egress

• Question 8:

  Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.

  Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim.

  Create a new ServiceAccount named psp-sa in the namespace restricted.

  Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent-volume-policy

  Create a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp-role to the created SA psp-sa.

  Hint:

  Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.

  POD Manifest:

  1.

  apiVersion: v1

  2.

  kind: Pod

  3.

  metadata:

  4.

  name:

  5.

  spec:

  6.

  containers:

  7.

  - name:

  8.

  image:

  9.

  volumeMounts: 10.- name: 11.mountPath: 12.volumes: 13.- name: 14.secret: 15.secretName:

  A. See the below:

  B. PlaceHolder

  Correct Answer: A

  apiVersion: policy/v1beta1

  kind: PodSecurityPolicy

  metadata:

  name: restricted

  annotations:

  seccomp.security.alpha.kubernetes.io/allowedProfileNames:

  'docker/default,runtime/default'

  apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec:

  privileged: false

  # Required to prevent escalations to root.

  allowPrivilegeEscalation: false

  # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth.

  requiredDropCapabilities:

  -ALL

  # Allow core volume types.

  volumes:

  -'configMap'

  -'emptyDir'

  -'projected'

  -'secret'

  -'downwardAPI'

  # Assume that persistentVolumes set up by the cluster admin are safe to use.

  -'persistentVolumeClaim'

  hostNetwork: false

  hostIPC: false

  hostPID: false

  runAsUser:

  # Require the container to run without root privileges.

  rule: 'MustRunAsNonRoot'

  seLinux:

  # This policy assumes the nodes are using AppArmor rather than SELinux.

  rule: 'RunAsAny'

  supplementalGroups:

  rule: 'MustRunAs'

  ranges:

  # Forbid adding the root group.

  -

  min: 1

  max: 65535

  fsGroup:

  rule: 'MustRunAs'

  ranges:

  # Forbid adding the root group.

  -

  min: 1

  max: 65535

  readOnlyRootFilesystem: false

• Question 9:

  You must complete this task on the following cluster/nodes: Cluster: immutable-cluster

  Master node: master1

  Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context immutable-cluster

  Context: It is best practice to design containers to be stateless and immutable.

  Task:

  Inspect Pods running in namespace prod and delete any Pod that is either not stateless or not immutable.

  Use the following strict interpretation of stateless and immutable:

  1.

  Pods being able to store data inside containers must be treated as not stateless.

  Note: You don't have to worry whether data is actually stored inside containers or not already.

  2.

  Pods being configured to be privileged in any way must be treated as potentially not stateless or not immutable.

  A. See the explanation below

  B. PlaceHolder

  Correct Answer: A

  

• Question 10:

  Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g:ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" -- cert="server.crt" --key="server.key" Output

  

  Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.

  A. See explanation below.

  B. PlaceHolder

  Correct Answer: A

  1.

  ETCD secret encryption can be verified with the help of etcdctl command line utility.

  2.

  ETCD secrets are stored at the path /registry/secrets/$namespace/$secret on the master node.

  3.

  The below command can be used to verify if the particular ETCD secret is encrypted or not.

  # ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C