Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.Fix all of the following violations that were found against the API server:-1.Ensure that the RotateKubeletServerCertificate argument is set to true.2.Ensure that the admission control plugin PodSecurityPolicy is set.3.Ensure that the --kubelet-certificate-authority argument is set as appropriate.4.Fix all of the following violations that were found against the Kubelet:-5.Ensure the --anonymous-auth argument is set to false.6.Ensure that the --authorization-mode argument is set to Webhook.7.Fix all of the following violations that were found against the ETCD:-8.Ensure that the --auto-tls argument is not set to true9.Ensure that the --peer-auto-tls argument is not set to true Hint: Take the use of Tool Kube-Bench
Answer(s): A
Fix all of the following violations that were found against the API server:-a) Ensure that the RotateKubeletServerCertificate argument is set to true.apiVersion: v1kind: Pod metadata:creationTimestamp: null labels:component: kubelet tier: control-plane name: kubelet namespace: kube-system spec:containers:- command:- kube-controller-manager+ - --feature-gates=RotateKubeletServerCertificate=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe:failureThreshold: 8httpGet:host: 127.0.0.1path: /healthz port: 6443scheme: HTTPSinitialDelaySeconds: 15timeoutSeconds: 15name: kubelet resources:requests:cpu: 250m volumeMounts:- mountPath: /etc/kubernetes/name: k8s readOnly: true- mountPath: /etc/ssl/certs name: certs- mountPath: /etc/pki name: pki hostNetwork: true volumes:- hostPath:path: /etc/kubernetes name: k8s- hostPath:path: /etc/ssl/certs name: certs- hostPath:path: /etc/pki name: pki b. Ensure that the admission control plugin PodSecurityPolicy is set.audit:"/bin/ps -ef |grep$apiserverbin| grep -v grep"tests:test_items:- flag: "--enable-admission-plugins"compare:op: has value: "PodSecurityPolicy"set: true remediation: |Follow the documentation and create Pod Security Policy objects as per your environment.Then, edit the API server pod specification file $apiserverconf on the master node and set the --enable-admission-plugins parameter to a value that includes PodSecurityPolicy :--enable-admission-plugins=...,PodSecurityPolicy,...Then restart the API Server.scored: true c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.audit:"/bin/ps -ef |grep$apiserverbin| grep -v grep"tests:test_items:- flag: "--kubelet-certificate-authority"set: true remediation: |Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file$apiserverconf on the master node and set the --kubelet-certificate- authority parameter to the path to the cert file for the certificate authority.--kubelet-certificate-authority=<ca-string>scored: trueFix all of the following violations that were found against the ETCD:-a) Ensure that the --auto-tls argument is not set to true Edit the etcd pod specification file $etcdconf on the master node and either remove the --auto-tls parameter or set it to false.--auto-tls=false b. Ensure that the --peer-auto-tls argument is not set to trueEdit the etcd pod specification file $etcdconf on the master node and either remove the --peer-auto-tls parameter or set it to false.--peer-auto-tls=false
Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim. Create a new ServiceAccount named psp-sa in the namespace restricted. Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent- volume-policyCreate a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp- role to the created SA psp-sa.Hint:Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.POD Manifest:apiVersion: v1kind: Pod metadata:name:spec:containers:- name:image:volumeMounts:- name:mountPath:volumes:- name:secret:secretName:
apiVersion: policy/v1beta1kind: PodSecurityPolicy metadata:name: restricted annotations:seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec:privileged: false# Required to prevent escalations to root.allowPrivilegeEscalation: false# This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth.requiredDropCapabilities:- ALL# Allow core volume types.volumes:- 'configMap'- 'emptyDir'- 'projected'- 'secret'- 'downwardAPI'# Assume that persistentVolumes set up by the cluster admin are safe to use.- 'persistentVolumeClaim'hostNetwork: false hostIPC: false hostPID: false runAsUser:# Require the container to run without root privileges.rule: 'MustRunAsNonRoot'seLinux:# This policy assumes the nodes are using AppArmor rather than SELinux.rule: 'RunAsAny'supplementalGroups:rule: 'MustRunAs'ranges:# Forbid adding the root group.- min: 1max: 65535fsGroup:rule: 'MustRunAs'ranges:# Forbid adding the root group.- min: 1max: 65535readOnlyRootFilesystem: false
Given an existing Pod named nginx-pod running in the namespace test-system, fetch the service- account-name used and put the content in /candidate/KSC00124.txt Create a new Role named dev-test-role in the namespace test-system, which can perform update operations, on resources of type namespaces.Create a new RoleBinding named dev-test-role-binding, which binds the newly created Role to the Pod's ServiceAccount ( found in the Nginx pod running in namespace test-system).
Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that1. logs are stored at /var/log/kubernetes/kubernetes-logs.txt.2. Log files are retained for 5 days.3. at maximum, a number of 10 old audit logs files are retained.Edit and extend the basic policy to log:1. Cronjobs changes at RequestResponse2. Log the request body of deployments changes in the namespace kube-system.3. Log all other resources in core and extensions at the Request level.4. Don't log watch requests by the "system:kube-proxy" on endpoints or
Create a RuntimeClass named untrusted using the prepared runtime handler named runsc. Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.
Post your Comments and Discuss Linux Foundation CKS exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CKS content, but please register or login to continue.