12 KiB
Task 2
Solve this question on: ssh cks8930
The Vulnerability Scanner trivy is installed on your main terminal. Use it to scan the following images for known CVEs:
nginx:1.16.1-alpine
k8s.gcr.io/kube-apiserver:v1.18.0
k8s.gcr.io/kube-controller-manager:v1.18.0
docker.io/weaveworks/weave-kube:2.7.0
Write all image names (including the tag, exactly as listed above) that don't contain the vulnerabilities CVE-2020-10878 or CVE-2020-1967 into /opt/course/2/good-images on cks8930.
Task 3
Controlling Access to the Kubernetes API
Solve this question on: ssh cks8930
You received a list from the DevSecOps team which performed a security investigation of the cluster. The list states the following about the apiserver setup:
Accessible through a NodePort Service Change the apiserver setup so that:
Only accessible through a ClusterIP Service ℹ️ Use sudo -i to become root which may be required for this question
Task 4
Configure Service Accounts for Pods Managing Service Accounts
Solve this question on: ssh cks5608
Update file /opt/course/4/stream-multiplex.yaml with the following changes:
Pods should have annotation token-lifetime with value 1200 ServiceAccount stream-multiplex should be used Disable automounting of ServiceAccount tokens The ServiceAccount token should be mounted at /var/run/secrets/custom/ with an expiration of 1200s Create the Deployment and ensure it's running without errors.
Task 5
Securing a Cluster
Solve this question on: ssh cks7262
You're asked to evaluate specific settings of the cluster against the CIS Benchmark recommendations. Use the kube-bench tool which is already installed on the nodes.
Connect to the worker node using ssh cks7262-node1 from cks7262.
On the controlplane node ensure (correct if necessary) that the CIS recommendations are set for:
The --profiling argument of the kube-controller-manager
The ownership of directory /var/lib/etcd
On the worker node ensure (correct if necessary) that the CIS recommendations are set for:
The permissions of the kubelet configuration /var/lib/kubelet/config.yaml
The --client-ca-file argument of the kubelet
ℹ️ Use sudo -i to become root which may be required for this question
Task 6
Configure a Security Context
Solve this question on: ssh cks2546
The Deployment immutable-deployment in Namespace team-purple should run immutable, it's created from file /opt/course/6/immutable-deployment.yaml on cks2546. Even after a successful break-in, it shouldn't be possible for an attacker to modify the filesystem of the running container.
Modify the Deployment in a way that no processes inside the container can modify the local filesystem, only /tmp directory should be writable. Don't modify the Docker image.
Save the updated YAML under /opt/course/6/immutable-deployment-new.yaml on cks2546 and update the running Deployment.
Task 7
Pod Security Standards Pod Security Admission
Solve this question on: ssh cks5608
Implement specific security policies in Namespace team-sepia.
Configure Pod Security Admission in mode audit for level baseline
Configure Pod Security Admission in mode warn for level restricted
Afterwards create the Pod from /opt/course/7/bad-pod.yaml and write any warnings or errors into /opt/course/7/bad-pod.log
Task 8
Solve this question on: ssh cks4024
Docker containers on cks4024 should run more isolated from each other by disabling inter-container communication.
Add "icc": false to the Docker config and ensure the Docker daemon is using the updated settings Create two Docker containers named container1 and container2 which should have image nginx:1-alpine restart always keep running in the background As result, the containers should not be able to ping each other on their IP addresses.
ℹ️ Run all Docker commands as root. Use sudo -i to become root
Task 9
AppArmor
Solve this question on: ssh cks7262
Some containers need to run more secure and restricted. There is an existing AppArmor profile located at /opt/course/9/profile on cks7262 for this.
Install the AppArmor profile on node cks7262-node1.
Connect using ssh cks7262-node1 from cks7262
Add label security=apparmor to the node
Create a Deployment named apparmor in Namespace default with:
One replica of image nginx:1-alpine NodeSelector for security=apparmor Single container named c1 with the AppArmor profile enabled only for this container The Pod might not run properly with the profile enabled. Write the logs of the Pod into /opt/course/9/logs on cks7262 so another team can work on getting the application running.
ℹ️ Use sudo -i to become root which may be required for this question
Task 10
Runtime Class
Solve this question on: ssh cks7262
Team purple wants to run some of their workloads more securely. Worker node cks7262-node1 is already configured so that containerd supports the runsc/gvisor runtime.
Connect to the worker node using ssh cks7262-node1 from cks7262.
Create a RuntimeClass named gvisor with handler runsc
Create a Pod that uses the RuntimeClass. The Pod should be in Namespace team-purple, named gvisor-test and of image nginx:1-alpine
Ensure the Pod only ever runs on a node named cks7262-node1
Write the output of the dmesg command of the successfully started Pod into /opt/course/10/gvisor-test-dmesg on cks7262
Task 11
Secrets Managing Secrets using kubectl
Solve this question on: ssh cks2546
There is Secret db-con in Namespace team-khaki-us-east-ad1. Update the password to 4c!29f_Ee2e and ensure all Pods currently using the Secret will work with the updated value.
Move Secret user-data from Namespace team-khaki-us-east-ad1 to team-khaki-us-east-ad2.
Convert ConfigMap app-data in Namespace team-khaki-us-east-ad1 to a Secret and delete the ConfigMap afterwards. Ensure all Pods that used the ConfigMap will continue to work and are now using the values from the Secret.
Task 12
Admission Control in Kubernetes
Solve this question on: ssh cks4024
Team White created an ImagePolicyWebhook solution at /opt/course/12/webhook on cks4024 which needs to be enabled for the cluster. There is an existing and working webhook-backend Service in Namespace team-white which will be the ImagePolicyWebhook backend.
Create an AdmissionConfiguration at /opt/course/12/webhook/admission-config.yaml which contains the following ImagePolicyWebhook configuration in the same file:
imagePolicy: kubeConfigFile: /etc/kubernetes/webhook/webhook.yaml allowTTL: 10 denyTTL: 10 retryBackoff: 20 defaultAllow: true Configure the apiserver to:
Mount /opt/course/12/webhook at /etc/kubernetes/webhook
Use the AdmissionConfiguration at path /etc/kubernetes/webhook/admission-config.yaml
Enable the ImagePolicyWebhook admission plugin
As result the ImagePolicyWebhook backend should prevent container images containing danger-danger from being used, any other image should still work.
ℹ️ Create a backup of /etc/kubernetes/manifests/kube-apiserver.yaml outside of /etc/kubernetes/manifests so you can revert back in case of issues
ℹ️ Use sudo -i to become root which may be required for this question
Task 13
Cilium Documentation
Solve this question on: ssh cks8930
There is a metadata service available at http://192.168.100.21:9055 on which nodes can reach sensitive data. Access to this needs to be restricted from Pods.
In Namespace metadata-access create a CiliumNetworkPolicy named default to:
Allow egress to 0.0.0.0/0 Allow egress to Endpoints in the same Namespace Allow egress to Endpoints in the kube-system Namespace Deny egress to 192.168.100.21 on port 9055 ℹ️ There are existing plain Nginx Pods with open port 80 in the Namespace which can be used for testing but need to remain unchanged. Perform simple connectivity tests like:
k -n metadata-access exec POD_NAME -- curl URL
Task 14
Encrypting Confidential Data at Rest
Solve this question on: ssh cks7262
An internal security audit requires to have secrets in the cluster encrypted. The team already created the needed EncryptionConfiguration at /etc/kubernetes/etcd/ec.yaml.
Write the non-encoded password that the aesgcm provider of that EncryptionConfiguration uses into /opt/course/14/password.txt The Apiserver should mount /etc/kubernetes/etcd on the host to /etc/kubernetes/etcd inside the container The Apiserver should use the EncryptionConfiguration from /etc/kubernetes/etcd/ec.yaml inside the container All Secrets in Namespace team-magenta should be stored encrypted in ETCD
Task 15
Ingress
Solve this question on: ssh cks2546
In Namespace team-pink there is an existing Nginx Ingress resource named secure which accepts two paths /app and /api which point to different ClusterIP Services.
From your main terminal you can connect to it using for example:
HTTP: curl -v http://secure-ingress.test:31080/app
HTTPS: curl -kv https://secure-ingress.test:31443/app
Right now it uses a default generated TLS certificate by the Nginx Ingress Controller.
You're asked to instead use the key and certificate provided at /opt/course/15/tls.key and /opt/course/15/tls.crt. As it's a self-signed certificate you need to use curl -k when connecting to it.
Task 16
Falco Documentation
Solve this question on: ssh cks5608
Add two new Falco rules to /etc/falco/falco_rules.local.yaml:
Named Custom Rule 1 with priority WARNING. It should find all containers that access files on the host with prefix /etc/kubernetes in the full path. It should output logs as:
custom_rule_1 file={{FILEPATH}} container={{CONTAINER_ID}} Named Custom Rule 2 with priority INFO. It should find all processes that perform kill syscalls. It should output logs as:
custom_rule_2 event_signal=%evt.arg.sig event_pid=%evt.arg.pid container={{CONTAINER_ID}} Only create the new rules without additional macros or lists.
Run Falco with your implemented rules for at least 30 seconds and write the produced logs into /opt/course/16/logs.
Task 17
Auditing
Solve this question on: ssh cks3477
Audit Logging has been enabled in the cluster with an Audit Policy located at /etc/kubernetes/audit/policy.yaml on cks3477.
Change the configuration so that only one backup of the logs is stored.
Alter the Policy in a way that it only stores logs:
From Secret resources, level Metadata From "system:nodes" userGroups, level RequestResponse After you update the Policy make sure to empty the log file so it only contains entries according to your changes, like using echo > /etc/kubernetes/audit/logs/audit.log.
ℹ️ You can use yq to render JSON more readable, like cat data.json | yq -p json -o json
ℹ️ Use sudo -i to become root which may be required for this question
Preview 1
Preview Question 1 Using RBAC Authorization
Solve this question on: ssh cks3477
You're asked to implement some RBAC for user gianna:
There are existing cluster-level RBAC resources in place to, among other things, ensure that user gianna can never read Secret contents cluster-wide. Confirm this is correct or restrict the existing RBAC resources to ensure this.
In addition, create more RBAC resources to allow user gianna to create Pods and Deployments in Namespaces security, restricted and internal. It's likely the user will receive these exact permissions as well for other Namespaces in the future.
To test your RBAC you can:
Switch to the other context with:
k config use-context gianna@infra-prod And afterwards switch back to the default context with:
k config use-context kubernetes-admin@kubernetes
Preview 2
Preview Question 2 Auditing Managing Secrets using kubectl
Solve this question on: ssh cks3477
Namespace security contains five Secrets of type Opaque which can be considered highly confidential. The latest Incident-Prevention-Investigation revealed that ServiceAccount p.auster had too broad access to the cluster for some time. This SA should never have had access to any Secrets in that Namespace.
Find out which Secrets in Namespace security this SA did access by looking at the Audit Logs under /opt/course/p2/audit.log.
Change the password to any new string of only those Secrets that were accessed by this SA.
ℹ️ You can use jq to render json more readable, like cat data.json | jq
Preview 3
Preview Question 3 Solve this question on: ssh cks8930
A security scan result shows that there is an unknown miner process running on one of the nodes in this cluster.
The report states that the process is listening on port 6666.
Kill the process and delete the binary.