Linux Foundation CKS Exam - Topic 1 Question 42 Discussion
Context:
Cluster:prod
Master node:master1
Worker node:worker1You can switch the cluster/configuration context using the following command:[desk@cli] $kubectl config use-context prodTask:
Analyse and edit the given Dockerfile (based on theubuntu:18:04image)
/home/cert_masters/Dockerfilefixing two instructions present in the file being prominent security/best-practice issues.Analyse and edit the given manifest file
/home/cert_masters/mydeployment.yamlfixing two fields present in the file being prominent security/best-practice issues.Note:Don't add or remove configuration settings; only modify the existing configuration settings, so that two configuration settings each are no longer security/best-practice concerns.
Should you need an unprivileged user for any of the tasks, use usernobodywith user id65535
A) Explanation:
1. For Dockerfile:Fix the image version & user name in Dockerfile
2. For mydeployment.yaml : Fix security contexts
Explanation
[desk@cli] $vim /home/cert_masters/Dockerfile
FROM ubuntu:latest # Remove this
FROM ubuntu:18.04 # Add this
USER root # Remove this
USER nobody # Add this
RUN apt get install -y lsof=4.72 wget=1.17.1 nginx=4.2
ENV ENVIRONMENT=testing
USER root # Remove this
USER nobody # Add this
CMD ['nginx -d']
[desk@cli] $vim/home/cert_masters/mydeployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
creationTimestamp: null
labels:
app: kafka
name: kafka
spec:
replicas: 1
selector:
matchLabels:
app: kafka
strategy: {}
template:
metadata:
creationTimestamp: null
labels:
app: kafka
spec:
containers:
- image: bitnami/kafka
name: kafka
volumeMounts:
- name: kafka-vol
mountPath: /var/lib/kafka
securityContext:
{'capabilities':{'add':['NET_ADMIN'],'drop':['all']},'privileged': True,'readOnlyRootFilesystem': False, 'runAsUser': 65535} # Delete This
{'capabilities':{'add':['NET_ADMIN'],'drop':['all']},'privileged': False,'readOnlyRootFilesystem': True, 'runAsUser': 65535} # Add This
resources: {}
volumes:
- name: kafka-vol
emptyDir: {}
status: {}
Pictorial View:
[desk@cli] $vim/home/cert_masters/mydeployment.yaml
MENU
Kallie
10 months agoIola
10 months agoKatie
10 months agoLetha
10 months agoBillye
11 months agoCristy
11 months agoGlenn
11 months agoAlonzo
11 months agoFrank
11 months agoNieves
11 months agoLelia
11 months agoAn
11 months agoCrista
11 months agoAn
11 months agoBelen
12 months agoBuck
12 months agoYaeko
12 months agoNorah
12 months ago