Kubernetes Security Certificate
Lernkarten für das CKS-Exam.
Lernkarten für das CKS-Exam.
From the kubeconfig extract the certificate of user restricted@infra-prod and write it decoded to /opt/course/1/cert.
k config view --raw -ojsonpath="{@.users[?(.name == 'restricted@infra-prod')].user.client-certificate-data}" | base64 -d > /opt/course/1/cert
The Vulnerability Scanner trivy is installed on your main terminal. Use it to scan the following images for known CVE "nginx". Check the image that don't contain the vulnerabilities CVE-2020-10878 or CVE-2020-1967
trivy image nginx | grep -E 'CVE-2020-10878|CVE-2020-1967'
Check which parameters the apiserver process is running with
ps aux | grep kube-apiserver
The apiserver runs as a static Pod, so we can edit the manifest. But before we do this we also create a copy in case we mess things up.
cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/3_kube-apiserver.yaml
Disable automounting of ServiceAccount tokens
spec:template:spec:automountServiceAccountToken: false
ServiceAccount stream-multiplex should be used
spec:template:spec:serviceAccountName: stream-multiplex
Run kube-bench against the controlplane and node components
kube-bench run --targets=master / --targets=node | grep {whatever} -A5 or -B5
Modify the Deployment in a way that no processes inside the container can modify the local filesystem, only /tmp directory should be writable. Don't modify the Docker image.
Write the output of the dmesg command of the successfully started Pod gvisor-test in namespace team-purple into /tmp
k exec gvisor-test -n team-purple > /tmp -- dmesg
How can you check whether the Docker service is running?
service docker status
A Docker config update is required, how can we find it?
find /etc/ | grep docker
How do you restart the Docker service?
service docker restart
Create a Docker container named container1 which should
- have image nginx:1-alpine
- restart always
- keep running in the background
docker run --detach --name container1 --restart always nginx:1-alpine
Copy the file /opt/course/9/profile onto the node cks7262-node1
scp /opt/course/9/profile cks7262-node1:~/
How do you load an AppArmor profile from a file?
sudo apparmor_parser --quiet ./profile
Add label security=apparmor to the node cks7262-node1
k label node cks7262-node1 security=apparmor
Encode the string 4c!29f_Ee2e to
echo -n '4c!29f_Ee2e' | base64
How can you avoid manually Base64-encoding values in a Kubernetes Secret?
Use the stringData field instead of data. Kubernetes will automatically perform the Base64 encoding.
How can you monitor running containers in real time?
watch crictl ps → watch = repeatedly executes a command / crictl ps = lists running containers of the Container Runtime Interface (CRI) / ps = process status
Using trivy: Generate a CycloneDX SBOM of image registry.k8s.io/kube-controller-manager:v1.31.0 Store it at /opt/course/1/sbom2.json on cks9640
trivy image --format cyclonedx --output /opt/course/1/sbom2.json registry.k8s.io/kube-controller-manager:v1.31.0
How can you verify a binary with sha512?
sha512sum binary-file
Were is the cluster KubeletConfiguration?
k -n kube-system edit cm kubelet-config
Download the latest Kubelet-Config, possible
kubeadm upgrade node phase kubelet-config
How do you restart the Kubelet?
service kubelet restart
Approve the CertificateSigningRequest fnamed csr-app-6c63ce3f
kubectl certificate approve app-6c63ce3f@users-pro
Create a CRT by signing the CSR using the CA of the cluster
openssl x509 -req -in user.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out user.crt -days 500
Get the CN subject that was used to create the new.csr
openssl req -in /opt/course/9/new.csr -noout -text
Get the base64 encoded content of the Certificate Request at /opt/course/9/new.csr without lines
cat /opt/course/9/new.csr | base64 | tr -d "\n"
There is an existing Secret called database-access in Namespace team-daisy. Read the complete Secret content directly from ETCD (using etcdctl) and store it into /opt/course/11/etcd-secret-content.
ETCDCTL_API=3 etcdctl --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key /etc/kubernetes/pki/apiserver-etcd-client.key --cacert /etc/kubernetes/pki/etcd/ca.crt get /registry/secrets/team-daisy/database-access
How can I connect into a running pod named pod1?
k exec -it pod1 -- sh
How can I read the env variables from a pod named pod1?
k exec pod1 -- env
-
- 1 / 31
-
Flashcards
From the kubeconfig extract the certificate of user restricted@infra-prod and write it decoded to /opt/course/1/cert.
k config view --raw -ojsonpath="{@.users[?(.name == 'restricted@infra-prod')].user.client-certificate-data}" | base64 -d > /opt/course/1/cert
The Vulnerability Scanner trivy is installed on your main terminal. Use it to scan the following images for known CVE "nginx". Check the image that don't contain the vulnerabilities CVE-2020-10878 or CVE-2020-1967
trivy image nginx | grep -E 'CVE-2020-10878|CVE-2020-1967'
Check which parameters the apiserver process is running with
ps aux | grep kube-apiserver
The apiserver runs as a static Pod, so we can edit the manifest. But before we do this we also create a copy in case we mess things up.
cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/3_kube-apiserver.yaml
Disable automounting of ServiceAccount tokens
spec:template:spec:automountServiceAccountToken: false
ServiceAccount stream-multiplex should be used
spec:template:spec:serviceAccountName: stream-multiplex
Run kube-bench against the controlplane and node components
kube-bench run --targets=master / --targets=node | grep {whatever} -A5 or -B5
Modify the Deployment in a way that no processes inside the container can modify the local filesystem, only /tmp directory should be writable. Don't modify the Docker image.
Write the output of the dmesg command of the successfully started Pod gvisor-test in namespace team-purple into /tmp
k exec gvisor-test -n team-purple > /tmp -- dmesg
How can you check whether the Docker service is running?
service docker status
A Docker config update is required, how can we find it?
find /etc/ | grep docker
How do you restart the Docker service?
service docker restart
Create a Docker container named container1 which should
- have image nginx:1-alpine
- restart always
- keep running in the background
docker run --detach --name container1 --restart always nginx:1-alpine
Copy the file /opt/course/9/profile onto the node cks7262-node1
scp /opt/course/9/profile cks7262-node1:~/
How do you load an AppArmor profile from a file?
sudo apparmor_parser --quiet ./profile
Add label security=apparmor to the node cks7262-node1
k label node cks7262-node1 security=apparmor
Encode the string 4c!29f_Ee2e to
echo -n '4c!29f_Ee2e' | base64
How can you avoid manually Base64-encoding values in a Kubernetes Secret?
Use the stringData field instead of data. Kubernetes will automatically perform the Base64 encoding.
How can you monitor running containers in real time?
watch crictl ps → watch = repeatedly executes a command / crictl ps = lists running containers of the Container Runtime Interface (CRI) / ps = process status
Using trivy: Generate a CycloneDX SBOM of image registry.k8s.io/kube-controller-manager:v1.31.0 Store it at /opt/course/1/sbom2.json on cks9640
trivy image --format cyclonedx --output /opt/course/1/sbom2.json registry.k8s.io/kube-controller-manager:v1.31.0
How can you verify a binary with sha512?
sha512sum binary-file
Were is the cluster KubeletConfiguration?
k -n kube-system edit cm kubelet-config
Download the latest Kubelet-Config, possible
kubeadm upgrade node phase kubelet-config
How do you restart the Kubelet?
service kubelet restart
Approve the CertificateSigningRequest fnamed csr-app-6c63ce3f
kubectl certificate approve app-6c63ce3f@users-pro
Create a CRT by signing the CSR using the CA of the cluster
openssl x509 -req -in user.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out user.crt -days 500
Get the CN subject that was used to create the new.csr
openssl req -in /opt/course/9/new.csr -noout -text
Get the base64 encoded content of the Certificate Request at /opt/course/9/new.csr without lines
cat /opt/course/9/new.csr | base64 | tr -d "\n"
There is an existing Secret called database-access in Namespace team-daisy. Read the complete Secret content directly from ETCD (using etcdctl) and store it into /opt/course/11/etcd-secret-content.
ETCDCTL_API=3 etcdctl --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key /etc/kubernetes/pki/apiserver-etcd-client.key --cacert /etc/kubernetes/pki/etcd/ca.crt get /registry/secrets/team-daisy/database-access
How can I connect into a running pod named pod1?
k exec -it pod1 -- sh
How can I read the env variables from a pod named pod1?
k exec pod1 -- env
