Linux Foundation CKS Online Practice Questions and Exam Preparation

Linux Foundation CKS Online Questions & Answers

• Question 41:

  CORRECT TEXT

  

  A container image scanner is set up on the cluster, but it's not yet fully integrated into the cluster s configuration. When complete, the container image scanner shall scan for and reject the use of vulnerable images.

  

  Given an incomplete configuration in directory /etc/kubernetes/epconfig and a functional container image scanner with HTTPS endpoint https://wakanda.local:8081 /image_policy:

  1. Enable the necessary plugins to create an image policy

  2. Validate the control configuration and change it to an implicit deny

  3. Edit the configuration to point to the provided HTTPS endpoint correctly

  Finally, test if the configuration is working by trying to deploy the vulnerable resource /root/KSSC00202/vulnerable-resource.yml.

  

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

  

  

  

  

  

  

  

  

  

• Question 42:

  Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.

  Ensure that Network Policy:

  1. Does not allow access to pod not listening on port 80.

  2. Does not allow access from Pods, not in namespace staging.

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  apiVersion: networking.k8s.io/v1

  kind: NetworkPolicy

  metadata:

  name: network-policy

  spec:

  podSelector: {} #selects all the pods in the namespace deployed policyTypes:

  -Ingress ingress:

  -ports: #in input traffic allowed only through 80 port only

  -protocol: TCP port: 80

• Question 43:

  Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that

  1. logs are stored at /var/log/kubernetes/kubernetes-logs.txt.

  2. Log files are retained for 5 days.

  3. at maximum, a number of 10 old audit logs files are retained.

  Edit and extend the basic policy to log:

  1. Cronjobs changes at RequestResponse

  2. Log the request body of deployments changes in the namespace kube-system.

  3. Log all other resources in core and extensions at the Request level.

  4. Don't log watch requests by the "system:kube-proxy" on endpoints or

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

  

  

• Question 44:

  Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.

  Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim.

  Create a new ServiceAccount named psp-sa in the namespace restricted.

  Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent-volume-policy

  Create a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp-role to the created SA psp-sa.

  Hint:

  Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.

  POD Manifest:

  1. apiVersion: v1

  2. kind: Pod

  3. metadata:

  4. name:

  5. spec:

  6. containers:

  7. - name:

  8. image:

  9. volumeMounts: 10.- name: 11.mountPath: 12.volumes: 13.- name: 14.secret: 15.secretName:

  A. See the below:
  B. PlaceHolder
  A. See the below:

  ---

  Explanation/Reference:

  apiVersion: policy/v1beta1

  kind: PodSecurityPolicy

  metadata:

  name: restricted

  annotations:

  seccomp.security.alpha.kubernetes.io/allowedProfileNames:

  'docker/default,runtime/default'

  apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec:

  privileged: false

  # Required to prevent escalations to root.

  allowPrivilegeEscalation: false

  # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth.

  requiredDropCapabilities:

  -ALL

  # Allow core volume types.

  volumes:

  -'configMap'

  -'emptyDir'

  -'projected'

  -'secret'

  -'downwardAPI'

  # Assume that persistentVolumes set up by the cluster admin are safe to use.

  -'persistentVolumeClaim'

  hostNetwork: false

  hostIPC: false

  hostPID: false

  runAsUser:

  # Require the container to run without root privileges.

  rule: 'MustRunAsNonRoot'

  seLinux:

  # This policy assumes the nodes are using AppArmor rather than SELinux.

  rule: 'RunAsAny'

  supplementalGroups:

  rule: 'MustRunAs'

  ranges:

  # Forbid adding the root group.

  -min: 1

  max: 65535

  fsGroup:

  rule: 'MustRunAs'

  ranges:

  # Forbid adding the root group.

  -min: 1

  max: 65535

  readOnlyRootFilesystem: false

• Question 45:

  Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.

  Fix all of the following violations that were found against the API server:

  1. Ensure the --authorization-mode argument includes RBAC

  2. Ensure the --authorization-mode argument includes Node

  3. Ensure that the --profiling argument is set to false

  Fix all of the following violations that were found against the Kubelet:

  1. Ensure the --anonymous-auth argument is set to false.

  2. Ensure that the --authorization-mode argument is set to Webhook. Fix all of the following violations that were found against the ETCD:

  Ensure that the --auto-tls argument is not set to true Hint: Take the use of Tool Kube-Bench

  A. See the below.
  B. PlaceHolder
  A. See the below.

  ---

  Explanation/Reference:

  API server:

  Ensure the --authorization-mode argument includes RBAC

  Turn on Role Based Access Control.Role Based Access Control (RBAC) allows fine- grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization

  mode.

  Fix - BuildtimeKubernetesapiVersion: v1

  kind: Pod

  metadata:

  creationTimestamp: null

  labels:

  component: kube-apiserver

  tier: control-plane

  name: kube-apiserver

  namespace: kube-system

  spec:

  containers:

  -command: + - kube-apiserver + - --authorization-mode=RBAC,Node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts:

  -mountPath: /etc/kubernetes/ name: k8s readOnly: true

  -mountPath: /etc/ssl/certs name: certs

  -mountPath: /etc/pki name: pki hostNetwork: true volumes:

  -hostPath: path: /etc/kubernetes name: k8s

  -hostPath: path: /etc/ssl/certs name: certs

  -hostPath: path: /etc/pki name: pki

  Ensure the --authorization-mode argument includes Node

  Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube- apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.

  --authorization-mode=Node,RBAC

  Audit:

  /bin/ps -ef | grep kube-apiserver | grep -v grep

  Expected result:

  'Node,RBAC' has 'Node'

  Ensure that the --profiling argument is set to false

  Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.

  --profiling=false

  Audit:

  /bin/ps -ef | grep kube-apiserver | grep -v grep

  Expected result:

  'false' is equal to 'false'

  Fix all of the following violations that were found against the Kubelet:

  uk.co.certification.simulator.questionpool.PList@e3e35a0

  Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous:

  enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.

  --anonymous-auth=false

  Based on your system, restart the kubelet service. For example:

  systemctl daemon-reload

  systemctl restart kubelet.service

  Audit:

  /bin/ps -fC kubelet

  Audit Config:

  /bin/cat /var/lib/kubelet/config.yaml

  Expected result:

  'false' is equal to 'false'

  2) Ensure that the --authorization-mode argument is set to Webhook.

  Audit

  docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization- mode=Webhook").string'

  Returned Value: --authorization-mode=Webhook

  Fix all of the following violations that were found against the ETCD:

  a. Ensure that the --auto-tls argument is not set to true

  Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.

  Fix - BuildtimeKubernetesapiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd namespace: kube-system spec: containers:

  -command:

  + - etcd

  + - --auto-tls=true

  image: k8s.gcr.io/etcd-amd64:3.2.18

  imagePullPolicy: IfNotPresent

  livenessProbe:

  exec:

  command:

  -/bin/sh

  - -ec

  - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 -- cacert=/etc/kubernetes/pki/etcd/ca.crt

  --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt -- key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo

  failureThreshold: 8

  initialDelaySeconds: 15

  timeoutSeconds: 15

  name: etcd-should-fail

  resources: {}

  volumeMounts:

  -mountPath: /var/lib/etcd

  name: etcd-data

  -mountPath: /etc/kubernetes/pki/etcd

  name: etcd-certs

  hostNetwork: true

  priorityClassName: system-cluster-critical

  volumes:

  -hostPath:

  path: /var/lib/etcd

  type: DirectoryOrCreate

  name: etcd-data

  -hostPath:

  path: /etc/kubernetes/pki/etcd

  type: DirectoryOrCreate

  name: etcd-certs

  status: {}

  

  

  

  

  

  

  

• Question 46:

  Create a User named john, create the CSR Request, fetch the certificate of the user after approving it.

  Create a Role name john-role to list secrets, pods in namespace john

  Finally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john.

  To Verify: Use the kubectl auth CLI command to verify the permissions.

  A. See the below.
  B. PlaceHolder
  A. See the below.

  ---

  Explanation/Reference:

  se kubectl to create a CSR and approve it.

  Get the list of CSRs:

  kubectl get csr

  Approve the CSR:

  kubectl certificate approve myuser

  Get the certificateRetrieve the certificate from the CSR:

  kubectl get csr/myuser -o yaml

  here are the role and role-binding to give john permission to create NEW_CRD resource:

  kubectl apply -f roleBindingJohn.yaml --as=john

  rolebinding.rbac.authorization.k8s.io/john_external-rosource-rb created

  kind: RoleBinding

  apiVersion: rbac.authorization.k8s.io/v1

  metadata:

  name: john_crd

  namespace: development-john

  subjects:

  -kind: User name: john apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: crd-creation

  kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: crd-creation rules:

  -apiGroups: ["kubernetes-client.io/v1"] resources: ["NEW_CRD"] verbs: ["create, list, get"]