CKS Exam Dumps : Certified Kubernetes Security Specialist (CKS)

Explanation[desk@cli] $vim runtime.yaml

• apiVersion: node.k8s.io/v1
• kind: RuntimeClass
• metadata:
•  name: not-trusted
• handler: runsc

[desk@cli] $ k apply -f runtime.yaml[desk@cli] $ k get pods

• NAME READY STATUS RESTARTS AGE
• nginx-6798fc88e8-chp6r 1/1 Running 0 11m
• nginx-6798fc88e8-fs53n 1/1 Running 0 11m
• nginx-6798fc88e8-ndved 1/1 Running 0 11m

[desk@cli] $ k get deploy

• NAME READY UP-TO-DATE AVAILABLE AGE
• nginx 3/3 11 3 5m

[desk@cli] $ k edit deploy nginx

Text Description automatically generated

1. For Dockerfile: Fix the image version & user name in Dockerfile2. For mydeployment.yaml : Fix security contexts

Explanation[desk@cli] $ vim /home/cert_masters/Dockerfile

FROM ubuntu:latest # Remove this

FROM ubuntu:18.04 # Add this

USER root                                                                            # Remove this

USER nobody                                                                          # Add this

RUN apt get install -y lsof=4.72 wget=1.17.1 nginx=4.2

ENV ENVIRONMENT=testing

USER root                                                                            # Remove this

USER nobody                                                                          # Add this

CMD ["nginx -d"]

Text Description automatically generated

[desk@cli] $ vim /home/cert_masters/mydeployment.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

creationTimestamp: null

labels:

app: kafka

name: kafka

spec:

replicas: 1

selector:

matchLabels:

app: kafka

strategy: {}

template:

metadata:

creationTimestamp: null

labels:

app: kafka

spec:

containers:

- image: bitnami/kafka

name: kafka

volumeMounts:

- name: kafka-vol

mountPath: /var/lib/kafka

securityContext:

{"capabilities":{"add":["NET_ADMIN"],"drop":["all"]},"privileged": True,"readOnlyRootFilesystem": False, "runAsUser": 65535} # Delete This

{"capabilities":{"add":["NET_ADMIN"],"drop":["all"]},"privileged": False,"readOnlyRootFilesystem": True, "runAsUser": 65535} # Add This

resources: {}

volumes:

- name: kafka-vol

emptyDir: {}

status: {}

Pictorial View:[desk@cli] $ vim /home/cert_masters/mydeployment.yaml

Text Description automatically generated

Text Description automatically generated

Text Description automatically generated