CKS Exam Dumps : Certified Kubernetes Security Specialist (CKS)

Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.

Ensure that Network Policy:-

1. Does not allow access to pod not listening on port 80.

2. Does not allow access from Pods, not in namespace staging.

Analyze and edit the given Dockerfile

FROM ubuntu:latest

 

RUN apt-get update -y

 

RUN apt-install nginx -y

 

COPY entrypoint.sh /

 

ENTRYPOINT ["/entrypoint.sh"]

 

USER ROOT

Fixing two instructions present in the file being prominent security best practice issues

Analyze and edit the deployment manifest file

apiVersion: v1

kind: Pod

metadata:

  name: security-context-demo-2

spec:

  securityContext:

    runAsUser: 1000

  containers:

  - name: sec-ctx-demo-2

    image: gcr.io/google-samples/node-hello:1.0

    securityContext:

      runAsUser: 0

      privileged: True

      allowPrivilegeEscalation: false

Fixing two fields present in the file being prominent security best practice issues

Don't add or remove configuration settings; only modify the existing configuration settings

Whenever you need an unprivileged user for any of the tasks, use user  test-user with the user id 5487

Cluster: scanner

Master node: controlplane

Worker node: worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $ kubectl config use-context scanner 

Given:

You may use Trivy's documentation.

Task:

Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.

Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images.

Trivy is pre-installed on the cluster's master node. Use cluster's master node to use Trivy.