104 lines
4.2 KiB
Markdown
104 lines
4.2 KiB
Markdown
# Task 1
|
|
|
|
Weight: 3
|
|
You are setting up a new Kubernetes cluster and need to secure Docker as part of the cluster setup.
|
|
|
|
Ensure that docker runs under the "root" group and that no external TCP connections are allowed to the docker daemon.
|
|
|
|
Ensure the configuration is persistent across restarts.
|
|
|
|
|
|
Is docker modified to run as part of the root group?
|
|
Has the docker daemon been modified to have no external TCP connections?
|
|
|
|
# Task 3
|
|
|
|
Create a service account named bot-sa in the automated namespace. Ensure that it does not get automatically mounted to workloads.
|
|
|
|
A workload named sweeper also exists in the same namespace. Update this deployment to use the newly created service account, and mount the service account token as a projected volume. Do not change any other fields in the deployment.
|
|
|
|
Has the service account bot-sa been created without auto-mount?
|
|
Has the bot-sa service account been set as the deployment's service account?
|
|
Has the bot-sa service account token been mounted to the deployment as a projected volume?
|
|
No default auto-mount on the Pod ?
|
|
|
|
|
|
# Task 6
|
|
|
|
You have an existing Kubernetes setup with the following services running:
|
|
|
|
Namespace:
|
|
system-hardening
|
|
|
|
Pods:
|
|
nginx-internal (Accessible internally)
|
|
nginx-external (Exposed externally via NodePort
|
|
service)
|
|
|
|
Services:
|
|
nginx-internal-service (Exposed as ClusterIP - internal-only)
|
|
nginx-external-service (Exposed as NodePort - accessible externally)
|
|
|
|
Objective:
|
|
Your task is to disable or unexpose ports to minimize external access to unnecessary services.
|
|
|
|
Has the service type for nginx-external-service been changed to ClusterIP?
|
|
|
|
# Task 7
|
|
|
|
A deployment named web-server is running in namespace restricted.
|
|
|
|
Identify why the deployment is not in a running state, and then fix the issue so that it is in a running state.
|
|
|
|
Has the deployment been fixed, and is the pod in a running state?
|
|
|
|
# Task 8
|
|
|
|
Configure the kubelet on the cluster2-controlplane node to disallow anonymous authentication.
|
|
|
|
The admin kubeconfig file for this cluster is located at:
|
|
/root/custom-config/admin.conf
|
|
|
|
Additionally, utilize this kubeconfig file to delete the role custom-role in namespace delta.
|
|
|
|
Ensure that, from the node, the cluster cannot be accessed with kubectl unless the --kubeconfig=/root/custom-config/admin.conf flag is explicitly provided.
|
|
|
|
|
|
Has anonymous auth been disabled on the kubelet?
|
|
Is the cluster not accessible without passing the --kubeconfig flag with kubectl?
|
|
Has the custom-role been deleted?
|
|
|
|
# Task 10
|
|
|
|
In the space namespace, a deployment rocket-server is exposed by a service of the same name.
|
|
|
|
Create an ingress resource named rocket-ingress to load balance the incoming traffic to the workload on path /.
|
|
|
|
Use the hostname rocket-server.local for the Ingress rules.
|
|
|
|
Utilize the TLS certificate stored in the secret rocket-tls in the space namespace to enable TLS traffic on that ingress resource.
|
|
|
|
Is the ingress resource correctly created?
|
|
Has the ingress TLS secret been attached?
|
|
Does the ingress route to the correct path and port?
|
|
Is curl working for the HTTPS connection via the ingress?
|
|
|
|
# Task 14
|
|
|
|
Enable auditing on this cluster using the basic policy file available at /etc/kubernetes/cluster-policy.yaml.
|
|
|
|
Store the logs at /var/log/cluster-audit.log and ensure they are retained for 10 days. The log size should not exceed 10MB and up to a maximum of 3 files should be kept at a time.
|
|
|
|
After enabling auditing on the cluster, update the basic policy file to track the following:
|
|
|
|
Delete activity on secrets in the kube-system namespace at the Metadata level
|
|
Changes to deployments in the default namespace at the Request level
|
|
All other requests at the Metadata level
|
|
Ensure that the updated policy is applied and in effect.
|
|
|
|
Note: A copy of the kube-apiserver.yaml is available in ~/ so you can revert if the configuration goes wrong. Ensure that the kube-apiserver is working correctly, as it will be required for grading the exam.
|
|
|
|
Does /var/log/cluster-audit.log exist with the logs written to it?
|
|
Does auditing follow the mentioned parameters as specified in the question?
|
|
Is the delete activity on secrets tracked at the Metadata level in the kube-system namespace?
|
|
Is the edit activity on deployments tracked at the Request level in the default namespace? |