docs: add Kubernetes CKS study notes

kubernetes/cks/kodekloud-mock-3.md

@@ -0,0 +1,104 @@
+# Task 1
+
+Weight: 3
+You are setting up a new Kubernetes cluster and need to secure Docker as part of the cluster setup.
+
+Ensure that docker runs under the "root" group and that no external TCP connections are allowed to the docker daemon.
+
+Ensure the configuration is persistent across restarts.
+
+
+Is docker modified to run as part of the root group?
+Has the docker daemon been modified to have no external TCP connections?
+
+# Task 3
+
+Create a service account named bot-sa in the automated namespace. Ensure that it does not get automatically mounted to workloads.
+
+A workload named sweeper also exists in the same namespace. Update this deployment to use the newly created service account, and mount the service account token as a projected volume. Do not change any other fields in the deployment.
+
+Has the service account bot-sa been created without auto-mount?
+Has the bot-sa service account been set as the deployment's service account?
+Has the bot-sa service account token been mounted to the deployment as a projected volume?
+No default auto-mount on the Pod ?
+
+
+# Task 6
+
+You have an existing Kubernetes setup with the following services running:
+
+Namespace:
+system-hardening
+
+Pods:
+nginx-internal (Accessible internally)
+nginx-external (Exposed externally via NodePort
+service)
+
+Services:
+nginx-internal-service (Exposed as ClusterIP - internal-only)
+nginx-external-service (Exposed as NodePort - accessible externally)
+
+Objective:
+Your task is to disable or unexpose ports to minimize external access to unnecessary services.
+
+Has the service type for nginx-external-service been changed to ClusterIP?
+
+# Task 7
+
+A deployment named web-server is running in namespace restricted.
+
+Identify why the deployment is not in a running state, and then fix the issue so that it is in a running state.
+
+Has the deployment been fixed, and is the pod in a running state?
+
+# Task 8
+
+Configure the kubelet on the cluster2-controlplane node to disallow anonymous authentication.
+
+The admin kubeconfig file for this cluster is located at:
+/root/custom-config/admin.conf
+
+Additionally, utilize this kubeconfig file to delete the role custom-role in namespace delta.
+
+Ensure that, from the node, the cluster cannot be accessed with kubectl unless the --kubeconfig=/root/custom-config/admin.conf flag is explicitly provided.
+
+
+Has anonymous auth been disabled on the kubelet?
+Is the cluster not accessible without passing the --kubeconfig flag with kubectl?
+Has the custom-role been deleted?
+
+# Task 10
+
+In the space namespace, a deployment rocket-server is exposed by a service of the same name.
+
+Create an ingress resource named rocket-ingress to load balance the incoming traffic to the workload on path /.
+
+Use the hostname rocket-server.local for the Ingress rules.
+
+Utilize the TLS certificate stored in the secret rocket-tls in the space namespace to enable TLS traffic on that ingress resource.
+
+Is the ingress resource correctly created?
+Has the ingress TLS secret been attached?
+Does the ingress route to the correct path and port?
+Is curl working for the HTTPS connection via the ingress?
+
+# Task 14
+
+Enable auditing on this cluster using the basic policy file available at /etc/kubernetes/cluster-policy.yaml.
+
+Store the logs at /var/log/cluster-audit.log and ensure they are retained for 10 days. The log size should not exceed 10MB and up to a maximum of 3 files should be kept at a time.
+
+After enabling auditing on the cluster, update the basic policy file to track the following:
+
+Delete activity on secrets in the kube-system namespace at the Metadata level
+Changes to deployments in the default namespace at the Request level
+All other requests at the Metadata level
+Ensure that the updated policy is applied and in effect.
+
+Note: A copy of the kube-apiserver.yaml is available in ~/ so you can revert if the configuration goes wrong. Ensure that the kube-apiserver is working correctly, as it will be required for grading the exam.
+
+Does /var/log/cluster-audit.log exist with the logs written to it?
+Does auditing follow the mentioned parameters as specified in the question?
+Is the delete activity on secrets tracked at the Metadata level in the kube-system namespace?
+Is the edit activity on deployments tracked at the Request level in the default namespace?