Hao DevSecOps

Task weight: 7% Use context: kubectl config use-context workload-prod There is a Deployment image-verify in Namespace team-blue which runs image registry.killer.sh:5000/image-verify:v1 . DevSecOps has asked you to improve this image by: Changing the base image to alpine:3.12 Not installing curl Updating nginx to use the version constraint >=1.18.0 Running the main process as user myuser Do not add any new lines to the Dockerfile, just edit existing ones. The file is located at /opt/cou...

Task weight: 4% Use context: kubectl config use-context workload-prod In Namespace team-pink there is an existing Nginx Ingress resources named secure which accepts two paths /app and /api which point to different ClusterIP Services. From your main terminal you can connect to it using for example: HTTP: curl -v http://secure-ingress.test:31080/app HTTPS: curl -kv https://secure-ingress.test:31443/app Right now it uses a default generated TLS certificate by the Nginx Ingress Controller. You’...

Task weight: 4% Use context: kubectl config use-context workload-prod There are Pods in Namespace team-yellow . A security investigation noticed that some processes running in these Pods are using the Syscall kill , which is forbidden by a Team Yellow internal policy. Find the offending Pod(s) and remove these by reducing the replicas of the parent Deployment to 0. 译文任务权重：4%。 使用环境: kubectl config use-context workload-prod 名称空间 team-yellow 中有一些 Pod。一项安全调查发现，在这些 Pod 中运行的一些进程正在使用 Syscall kill...

Task weight: 7% Use context: kubectl config use-context infra-prod There is a metadata service available at http://192.168.100.21:32000 on which Nodes can reach sensitive data, like cloud credentials for initialisation. By default, all Pods in the cluster also have access to this endpoint. The DevSecOps team has asked you to restrict access to this metadata server. In Namespace metadata-access : Create a NetworkPolicy named metadata-deny which prevents egress to 192.168.100.21 for all Pods ...

Task weight: 8% Use context: kubectl config use-context restricted@infra-prod You’re asked to investigate a possible permission escape in Namespace restricted . The context authenticates as user restricted which has only limited permissions and shouldn’t be able to read Secret values. Try to find the password-key values of the Secrets secret1 , secret2 and secret3 in Namespace restricted . Write the decoded plaintext values into files /opt/course/12/secret1 , /opt/course/12/secret2 and /...

Task weight: 7% Use context: kubectl config use-context workload-prod There is an existing Secret called database-access in Namespace team-green . Read the complete Secret content directly from ETCD (using etcdctl ) and store it into /opt/course/11/etcd-secret-content . Write the plain and decoded Secret’s value of key “pass” into /opt/course/11/database-password . 译文任务权重：7%。 使用环境：kubectl config use-context workload-prod 在命名空间 team-green 中有一个名为 data-access 的现有 Secret。 直接从 ETCD 读取完整的 Secr...

Task weight: 4% Use context: kubectl config use-context workload-prod Team purple wants to run some of their workloads more secure. Worker node cluster1-node2 has container engine containerd already installed and it’s configured to support the runsc/gvisor runtime. Create a RuntimeClass named gvisor with handler runsc . Create a Pod that uses the RuntimeClass. The Pod should be in Namespace team-purple , named gvisor-test and of image nginx:1.19.2 . Make sure the Pod runs on cluster1...

Task weight: 3% Use context: kubectl config use-context workload-prod Some containers need to run more secure and restricted. There is an existing AppArmor profile located at /opt/course/9/profile for this. Install the AppArmor profile on Node cluster1-node1 . Connect using ssh cluster1-node1 . Add label security=apparmor to the Node Create a Deployment named apparmor in Namespace default with: One replica of image nginx:1.19.2 NodeSelector for security=apparmor Single container named c1 w...

Task weight: 3% Use context: kubectl config use-context workload-prod The Kubernetes Dashboard is installed in Namespace kubernetes-dashboard and is configured to: Allow users to “skip login” Allow insecure access (HTTP without authentication) Allow basic authentication Allow access from outside the cluster You are asked to make it more secure by: Deny users to “skip login” Deny insecure access, enforce HTTPS (self signed certificates are ok for now) Add the --auto-generate-certificates ar...

Task weight: 6% Use context: kubectl config use-context infra-prod The Open Policy Agent and Gatekeeper have been installed to, among other things, enforce blacklisting of certain image registries. Alter the existing constraint and/or template to also blacklist images from very-bad-registry.com . Test it by creating a single Pod using image very-bad-registry.com/image in Namespace default , it shouldn’t work. You can also verify your changes by looking at the existing Deployment untrus...