Create a new NetworkPolicy named deny-all in the namespace testing which denies all traffic of type ingress and egress traffic
Answer(s): A
You can create a "default" isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any ingress traffic to those pods.---apiVersion: networking.k8s.io/v1kind: NetworkPolicy metadata:name: default-deny-ingress spec:podSelector: {}policyTypes:- IngressYou can create a "default" egress isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any egress traffic from those pods.---apiVersion: networking.k8s.io/v1kind: NetworkPolicy metadata:name: allow-all-egress spec:podSelector: {}egress:- {}policyTypes:- EgressDefault deny all ingress and all egress trafficYou can create a "default" policy for a namespace which prevents all ingress AND egress traffic by creating the following NetworkPolicy in that namespace.---apiVersion: networking.k8s.io/v1kind: NetworkPolicy metadata:name: default-deny-all spec:podSelector: {}policyTypes:- Ingress- EgressThis ensures that even pods that aren't selected by any other NetworkPolicy will not be allowed ingress or egress traffic.
a) Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace.Store the value of the token in the token.txtb) Create a new secret named test-db-secret in the DB namespace with the following content:username: mysql password: password@123Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path /etc/mysql-credentials
To add a Kubernetes cluster to your project, group, or instance:Navigate to your:Project's Operations > Kubernetes page, for a project-level cluster.Group's Kubernetes page, for a group-level cluster.Admin Area > Kubernetes page, for an instance-level cluster.Click Add Kubernetes cluster.Click the Add existing cluster tab and fill in the details:Kubernetes cluster name (required) - The name you wish to give the cluster. Environment scope (required) - The associated environment to this cluster. API URL (required) - It's the URL that GitLab uses to access the Kubernetes API. Kubernetes exposes several APIs, we want the "base" URL that is common to all of them. For example, https://kubernetes.example.com rather than https://kubernetes.example.com/api/v1.Get the API URL by running this command:kubectl cluster-info | grep -E 'Kubernetes master|Kubernetes control plane' | awk '/http/ {print $NF}' CA certificate (required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We use the certificate created by default.List the secrets with kubectl get secrets, and one should be named similar to default-token-xxxxx.Copy that token name for use below.Get the certificate by running this command:kubectl get secret <secret name> -o jsonpath="{['data']['ca\.crt']}"
use the Trivy to scan the following images,1. amazonlinux:12. k8s.gcr.io/kube-controller-manager:v1.18.6Look for images with HIGH or CRITICAL severity vulnerabilities and store the output of the same in /opt/trivy-vulnerable.txt
Two tools are pre-installed on the cluster's worker node:sysdig falcoUsing the tool of your choice (including any non pre-installed tool), analyze the container's behavior for at least 30 seconds, using filters that detect newly spawning and executing processes.Store an incident file at /opt/KSRS00101/alerts/details, containing the detected incidents, one per line, in the following format:The following example shows a properly formatted incident file:
Create a User named john, create the CSR Request, fetch the certificate of the user after approving it. Create a Role name john-role to list secrets, pods in namespace john Finally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john.To Verify: Use the kubectl auth CLI command to verify the permissions.
se kubectl to create a CSR and approve it.Get the list of CSRs:kubectl get csrApprove the CSR:kubectl certificate approve myuserGet the certificateRetrieve the certificate from the CSR:kubectl get csr/myuser -o yaml here are the role and role-binding to give john permission to create NEW_CRD resource:kubectl apply -f roleBindingJohn.yaml --as=john rolebinding.rbac.authorization.k8s.io/john_external-rosource-rb created kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1metadata:name: john_crd namespace: development-john subjects:- kind: User name: john apiGroup: rbac.authorization.k8s.io roleRef:kind: ClusterRole name: crd-creation kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1metadata:name: crd-creation rules:- apiGroups: ["kubernetes-client.io/v1"]resources: ["NEW_CRD"]verbs: ["create, list, get"]
Post your Comments and Discuss Linux Foundation CKS exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CKS content, but please register or login to continue.