CKS Exam Dumps : Certified Kubernetes Security Specialist (CKS)

Context

A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.

Task

Given an existing Pod named web-pod running in the namespace security.

Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operations, only on resources of type services.

Create a new Role named role-2 in the namespace security, which only allows performing update

operations, only on resources of type namespaces.

Create a new RoleBinding named role-2-binding binding the newly created Role to the Pod's ServiceAccount.

Task

Create a NetworkPolicy named pod-access to restrict access to Pod users-service running in namespace dev-team.

Only allow the following Pods to connect to Pod users-service:

Pods in the namespace qa

Pods with label environment: testing, in any namespace

Analyze and edit the given Dockerfile

FROM ubuntu:latest

 

RUN apt-get update -y

 

RUN apt-install nginx -y

 

COPY entrypoint.sh /

 

ENTRYPOINT ["/entrypoint.sh"]

 

USER ROOT

Fixing two instructions present in the file being prominent security best practice issues

Analyze and edit the deployment manifest file

apiVersion: v1

kind: Pod

metadata:

  name: security-context-demo-2

spec:

  securityContext:

    runAsUser: 1000

  containers:

  - name: sec-ctx-demo-2

    image: gcr.io/google-samples/node-hello:1.0

    securityContext:

      runAsUser: 0

      privileged: True

      allowPrivilegeEscalation: false

Fixing two fields present in the file being prominent security best practice issues

Don't add or remove configuration settings; only modify the existing configuration settings

Whenever you need an unprivileged user for any of the tasks, use user  test-user with the user id 5487