Linux Foundation CKS Exam - Topic 1 Question 42 Discussion

Question

Context:
Cluster:prod
Master node:master1
Worker node:worker1You can switch the cluster/configuration context using the following command:[desk@cli] $kubectl config use-context prodTask:
Analyse and edit the given Dockerfile (based on theubuntu:18:04image)
/home/cert_masters/Dockerfilefixing two instructions present in the file being prominent security/best-practice issues.Analyse and edit the given manifest file
/home/cert_masters/mydeployment.yamlfixing two fields present in the file being prominent security/best-practice issues.Note:Don't add or remove configuration settings; only modify the existing configuration settings, so that two configuration settings each are no longer security/best-practice concerns.
Should you need an unprivileged user for any of the tasks, use usernobodywith user id65535

Nana · Accepted Answer

A) Explanation:
1. For Dockerfile:Fix the image version & user name in Dockerfile
2. For mydeployment.yaml : Fix security contexts
Explanation
[desk@cli] $vim /home/cert_masters/Dockerfile
FROM ubuntu:latest                                                                   # Remove this
FROM ubuntu:18.04                                                                    # Add this
USER root                                      # Remove this
USER nobody                                     # Add this
RUN apt get install -y lsof=4.72 wget=1.17.1 nginx=4.2
ENV ENVIRONMENT=testing
USER root                                      # Remove this
USER nobody                                     # Add this
CMD ['nginx -d']
[desk@cli] $vim/home/cert_masters/mydeployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
creationTimestamp: null
labels:
app: kafka
name: kafka
spec:
replicas: 1
selector:
matchLabels:
app: kafka
strategy: {}
template:
metadata:
creationTimestamp: null
labels:
app: kafka
spec:
containers:
- image: bitnami/kafka
name: kafka
volumeMounts:
- name: kafka-vol
mountPath: /var/lib/kafka
securityContext:
{'capabilities':{'add':['NET_ADMIN'],'drop':['all']},'privileged': True,'readOnlyRootFilesystem': False, 'runAsUser': 65535}                     # Delete This
{'capabilities':{'add':['NET_ADMIN'],'drop':['all']},'privileged': False,'readOnlyRootFilesystem': True, 'runAsUser': 65535}                       # Add This
resources: {}
volumes:
- name: kafka-vol
emptyDir: {}
status: {}
Pictorial View:
[desk@cli] $vim/home/cert_masters/mydeployment.yaml