CKS Questions and Answers
Question # 1
Task
Analyze and edit the given Dockerfile /home/candidate/KSSC00301/Docker file (based on the ubuntu:16.04 image), fixing two instructions present in the file that are prominent security/best-practice issues.
Analyze and edit the given manifest file /home/candidate/KSSC00301/deployment.yaml, fixing two fields present in the file that are prominent security/best-practice issues.
Text
Description automatically generated
Text
Description automatically generated
Text
Description automatically generated
Graphical user interface, text
Description automatically generated
Question # 2
On the Cluster worker node, enforce the prepared AppArmor profile
- #include
- Â
- profile nginx-deny flags=(attach_disconnected) {
- Â #include
- Â
- Â file,
- Â
- Â # Deny all file writes.
- Â deny /** w,
- }
- EOF'
Edit the prepared manifest file to include the AppArmor profile.
- apiVersion: v1
- kind: Pod
- metadata:
- Â name: apparmor-pod
- spec:
- Â containers:
- Â - name: apparmor-pod
- Â Â image: nginx
Finally, apply the manifests files and create the Pod specified on it.
Verify: Try to make a file inside the directory which is restricted.
Text
Description automatically generated
Text
Description automatically generated
Text
Description automatically generated
Question # 3
Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.
Ensure that Network Policy:-
1. Does not allow access to pod not listening on port 80.
2. Does not allow access from Pods, not in namespace staging.
