CKS Exam Dumps – Our Features

Create a Pod name Nginx-pod inside the namespace testing, Create a service for the Nginx-pod named nginx-svc, using the ingress of your choice, run the ingress on tls, secure port.

• A . Explanation:
  $ kubectl get ing -n <namespace-of-ingress-resource>
  NAME HOSTS ADDRESS PORTS AGE
  cafe-ingress cafe.com 10.0.2.15 80 25s
  $ kubectl describe ing <ingress-resource-name> -n <namespace-of-ingress-resource>
  Name: cafe-ingress
  Namespace: default
  Address: 10.0.2.15
  Default backend: default-http-backend:80 (172.17.0.5:8080)
  Rules:
  Host Path Backends
  ---- ---- --------
  cafe.com
  /tea-svc:80 (<none>)
  /coffee-svc:80 (<none>)
  Annotations:
  kubectl.kubernetes.io/last-applied-configuration: {'apiVersion':'networking.k8s.io/v1','kind':'Ingress','metadata':{'annotations':{},'name':'cafe-ingress','namespace':'default','selfLink':'/apis/networking/v1/namespaces/default/ingresses/cafe-ingress'},'spec':{'rules':[{'host':'cafe.com','http':{'paths':[{'backend':{'serviceName':'tea-svc','servicePort':80},'path':'/tea'},{'backend':{'serviceName':'coffee-svc','servicePort':80},'path':'/coffee'}]}}]},'status':{'loadBalancer':{'ingress':[{'ip':'169.48.142.110'}]}}}
  Events:
  Type Reason Age From Message
  ---- ------ ---- ---- -------
  Normal CREATE 1m ingress-nginx-controller Ingress default/cafe-ingress
  Normal UPDATE 58s ingress-nginx-controller Ingress default/cafe-ingress
  $ kubectl get pods -n <namespace-of-ingress-controller>
  NAME READY STATUS RESTARTS AGE
  ingress-nginx-controller-67956bf89d-fv58j 1/1 Running 0 1m
  $ kubectl logs -n <namespace> ingress-nginx-controller-67956bf89d-fv58j
  -------------------------------------------------------------------------------
  NGINX Ingress controller
  Release: 0.14.0
  Build: git-734361d
  Repository: https://github.com/kubernetes/ingress-nginx
  -------------------------------------------------------------------------------
  ....
  

Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that1. logs are stored at /var/log/kubernetes-logs.txt.2. Log files are retained for 12 days.3. at maximum, a number of 8 old audit logs files are retained.4. set the maximum size before getting rotated to 200MBEdit and extend the basic policy to log:1. namespaces changes at RequestResponse2. Log the request body of secrets changes in the namespace kube-system.3. Log all other resources in core and extensions at the Request level.4. Log 'pods/portforward', 'services/proxy' at Metadata level.5. Omit the Stage RequestReceivedAll other requests at the Metadata level

• A . Explanation:
  Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records.
  You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes Benchmark controls.
  The audit log can be enabled by default using the following configuration incluster.yml:
  services:
  kube-api:
  audit_log:
  enabled: true
  When the audit log is enabled, you should be able to see the default values at/etc/kubernetes/audit-policy.yaml
  The log backend writes audit events to a file inJSONlinesformat. You can configure the log audit backend using the followingkube-apiserverflags:
  --audit-log-pathspecifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend.-means standard out
  --audit-log-maxagedefined the maximum number of days to retain old audit log files
  --audit-log-maxbackupdefines the maximum number of audit log files to retain
  --audit-log-maxsizedefines the maximum size in megabytes of the audit log file before it gets rotated
  If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount thehostPathto the location of the policy file and log file, so that audit records are persisted. For example:
  --audit-policy-file=/etc/kubernetes/audit-policy.yaml \
  --audit-log-path=/var/log/audit.log
  

Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.

• A . Explanation:
  root# netstat -ltnup
  Active Internet connections (only servers)
  Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
  tcp 0 127.0.0.1:17600 0.0.0.0:* LISTEN 1293/dropbox
  tcp 0 127.0.0.1:17603 0.0.0.0:* LISTEN 1293/dropbox
  tcp 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd
  tcp 0 127.0.0.1:9393 0.0.0.0:* LISTEN 900/perl
  tcp 0 :::80 :::* LISTEN 9583/docker-proxy
  tcp 0 :::443 :::* LISTEN 9571/docker-proxy
  udp 0 0.0.0.0:68 0.0.0.0:* 8822/dhcpcd
  ...
  root# netstat -ltnup | grep ':22'
  tcp 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd
  Thesscommand is the replacement of thenetstatcommand.
  Now let's see how to use thesscommand to see which process is listening on port 22:
  root# ss -ltnup 'sport = :22'
  Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
  tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:('sshd',pid=575,fd=3))
  

a. Retrieve the content of the existing secret nameddefault-token-xxxxxin the testing namespace.Store the value of the token in the token.txtb. Create a new secret named test-db-secret in the DB namespace with the following content:username:mysqlpassword:password@123Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path /etc/mysql-credentials

• A . Explanation:
  To add a Kubernetes cluster to your project, group, or instance:
  Navigate to your:
  Project'sOperations > Kubernetespage, for a project-level cluster.
  Group'sKubernetespage, for a group-level cluster.
  Admin Area >Kubernetespage, for an instance-level cluster.
  ClickAdd Kubernetes cluster.
  Click theAdd existing clustertab and fill in the details:
  Kubernetes cluster name(required) - The name you wish to give the cluster.
  Environment scope(required) - Theassociated environmentto this cluster.
  API URL(required) - It's the URL that GitLab uses to access the Kubernetes API. Kubernetes exposes several APIs, we want the ''base'' URL that is common to all of them. For example,https://kubernetes.example.comrather thanhttps://kubernetes.example.com/api/v1.
  Get the API URL by running this command:
  kubectl cluster-info | grep -E 'Kubernetes master|Kubernetes control plane' | awk '/http/ {print $NF}'
  CA certificate(required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We use the certificate created by default.
  List the secrets withkubectl get secrets, and one should be named similar todefault-token-xxxxx. Copy that token name for use below.
  Get the certificate by running this command:
  kubectl get secret <secret name> -o jsonpath='{['data']['ca\.crt']}'
  

Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim.Create a new ServiceAccount named psp-sa in the namespace restricted.Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent-volume-policyCreate a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp-role to the created SA psp-sa.Hint:Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.POD Manifest:apiVersion: v1kind: Podmetadata:name:spec:containers:- name:image:volumeMounts:- name:mountPath:volumes:- name:secret:secretName:

• A . Explanation:
  apiVersion: policy/v1beta1
  kind: PodSecurityPolicy
  metadata:
  name: restricted
  annotations:
  seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
  apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
  seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
  apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
  spec:
  privileged: false
  # Required to prevent escalations to root.
  allowPrivilegeEscalation: false
  # This is redundant with non-root + disallow privilege escalation,
  # but we can provide it for defense in depth.
  requiredDropCapabilities:
  - ALL
  # Allow core volume types.
  volumes:
  - 'configMap'
  - 'emptyDir'
  - 'projected'
  - 'secret'
  - 'downwardAPI'
  # Assume that persistentVolumes set up by the cluster admin are safe to use.
  - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
  # Require the container to run without root privileges.
  rule: 'MustRunAsNonRoot'
  seLinux:
  # This policy assumes the nodes are using AppArmor rather than SELinux.
  rule: 'RunAsAny'
  supplementalGroups:
  rule: 'MustRunAs'
  ranges:
  # Forbid adding the root group.
  - min: 1
  max: 65535
  fsGroup:
  rule: 'MustRunAs'
  ranges:
  # Forbid adding the root group.
  - min: 1
  max: 65535
  readOnlyRootFilesystem: false
  

Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class

• A . Explanation:
  Install the Runtime Class for gVisor
  { # Step 1: Install a RuntimeClass
  cat <<EOF | kubectl apply -f -
  apiVersion: node.k8s.io/v1beta1
  kind: RuntimeClass
  metadata:
  name: gvisor
  handler: runsc
  EOF
  }
  Create a Pod with the gVisor Runtime Class
  { # Step 2: Create a pod
  cat <<EOF | kubectl apply -f -
  apiVersion: v1
  kind: Pod
  metadata:
  name: nginx-gvisor
  spec:
  runtimeClassName: gvisor
  containers:
  - name: nginx
  image: nginx
  EOF
  }
  Verify that the Pod is running
  { # Step 3: Get the pod
  kubectl get pod nginx-gvisor -o wide
  }
  

Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.Fix all of the following violations that were found against theAPI server:-a. Ensure that the RotateKubeletServerCertificate argument is set to true.b. Ensure that the admission control plugin PodSecurityPolicy is set.c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.Fix all of the following violations that were found against theKubelet:-a. Ensure the --anonymous-auth argument is set to false.b. Ensure that the --authorization-mode argument is set to Webhook.Fix all of the following violations that were found against theETCD:-a. Ensure that the --auto-tls argument is not set to trueb. Ensure that the --peer-auto-tls argument is not set to trueHint: Take the use of Tool Kube-Bench

• A . Explanation:
  Fix all of the following violations that were found against theAPI server:-
  a. Ensure that the RotateKubeletServerCertificate argument is set to true.
  apiVersion: v1
  kind: Pod
  metadata:
  creationTimestamp: null
  labels:
  component: kubelet
  tier: control-plane
  name: kubelet
  namespace: kube-system
  spec:
  containers:
  - command:
  - kube-controller-manager
  + - --feature-gates=RotateKubeletServerCertificate=true
  image: gcr.io/google_containers/kubelet-amd64:v1.6.0
  livenessProbe:
  failureThreshold: 8
  httpGet:
  host: 127.0.0.1
  path: /healthz
  port: 6443
  scheme: HTTPS
  initialDelaySeconds: 15
  timeoutSeconds: 15
  name: kubelet
  resources:
  requests:
  cpu: 250m
  volumeMounts:
  - mountPath: /etc/kubernetes/
  name: k8s
  readOnly: true
  - mountPath: /etc/ssl/certs
  name: certs
  - mountPath: /etc/pki
  name: pki
  hostNetwork: true
  volumes:
  - hostPath:
  path: /etc/kubernetes
  name: k8s
  - hostPath:
  path: /etc/ssl/certs
  name: certs
  - hostPath:
  path: /etc/pki
  name: pki
  b. Ensure that the admission control plugin PodSecurityPolicy is set.
  audit: '/bin/ps -ef | grep $apiserverbin | grep -v grep'
  tests:
  test_items:
  - flag: '--enable-admission-plugins'
  compare:
  op: has
  value: 'PodSecurityPolicy'
  set: true
  remediation: |
  Follow the documentation and create Pod Security Policy objects as per your environment.
  Then, edit the API server pod specification file $apiserverconf
  on the master node and set the --enable-admission-plugins parameter to a
  value that includes PodSecurityPolicy :
  --enable-admission-plugins=...,PodSecurityPolicy,...
  Then restart the API Server.
  scored: true
  c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
  audit: '/bin/ps -ef | grep $apiserverbin | grep -v grep'
  tests:
  test_items:
  - flag: '--kubelet-certificate-authority'
  set: true
  remediation: |
  Follow the Kubernetes documentation and setup the TLS connection between the
  apiserver and kubelets. Then, edit the API server pod specification file
  $apiserverconf on the master node and set the --kubelet-certificate-authority
  parameter to the path to the cert file for the certificate authority.
  --kubelet-certificate-authority=<ca-string>
  scored: true
  Fix all of the following violations that were found against theETCD:-
  a. Ensure that the --auto-tls argument is not set to true
  Edit the etcd pod specification file $etcdconf on the master
  node and either remove the --auto-tls parameter or set it to false.
  --auto-tls=false
  b. Ensure that the --peer-auto-tls argument is not set to true
  Edit the etcd pod specification file $etcdconf on the master
  node and either remove the --peer-auto-tls parameter or set it to false.
  --peer-auto-tls=false
  

Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.Ensure that Network Policy:-1. Does not allow access to pod not listening on port 80.2. Does not allow access from Pods, not in namespace staging.

• A . Explanation:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
  name: network-policy
  spec:
  podSelector: {} #selects all the pods in the namespace deployed
  policyTypes:
  - Ingress
  ingress:
  - ports: #in input traffic allowed only through 80 port only
  - protocol: TCP
  port: 80
  

Create a User named john, create the CSR Request, fetch the certificate of the user after approving it.Create a Role name john-role to list secrets, pods in namespace johnFinally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john.To Verify:Use the kubectl auth CLI command to verify the permissions.

• A . Explanation:
  se kubectl to create a CSR and approve it.
  Get the list of CSRs:
  kubectl get csr
  Approve the CSR:
  kubectl certificate approve myuser
  Get the certificate
  Retrieve the certificate from the CSR:
  kubectl get csr/myuser -o yaml
  here are the role and role-binding to give john permission to create NEW_CRD resource:
  kubectl apply -f roleBindingJohn.yaml --as=john
  rolebinding.rbac.authorization.k8s.io/john_external-rosource-rb created
  kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
  name: john_crd
  namespace: development-john
  subjects:
  - kind: User
  name: john
  apiGroup: rbac.authorization.k8s.io
  roleRef:
  kind: ClusterRole
  name: crd-creation
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
  name: crd-creation
  rules:
  - apiGroups: ['kubernetes-client.io/v1']
  resources: ['NEW_CRD']
  verbs: ['create, list, get']
  

Using the runtime detection tool Falco, Analyse the container behavior for at least 20 seconds, using filters that detect newly spawning and executing processes in a single container of Nginx.store the incident file art /opt/falco-incident.txt, containing the detected incidents. one per line, in the format[timestamp],[uid],[processName]

• Send us your feedback on it.
• Send us your