Discuss Linux Foundation CKS Exam Topic 1 Question 46

Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.

kubesec-test.yaml

apiVersion: v1

kind: Pod

metadata:

name: kubesec-demo

spec:

containers:

- name: kubesec-demo

image: gcr.io/google-samples/node-hello:1.0

securityContext:

readOnlyRootFilesystem: true

Hint:docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml

AExplanation:
kubesec scan k8s-deployment.yaml
cat <<EOF > kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
EOF
kubesec scan kubesec-test.yaml
docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml
kubesec http 8080 &
[1] 12345
{'severity':'info','timestamp':'2019-05-12T11:58:34.662+0100','caller':'server/server.go:69','message':'Starting HTTP server on port 8080'}
curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml http://localhost:8080/scan
[
{
'object': 'Pod/security-context-demo.default',
'valid': true,
'message': 'Failed with a score of -30 points',
'score': -30,
'scoring': {
'critical': [
{
'selector': 'containers[] .securityContext .capabilities .add == SYS_ADMIN',
'reason': 'CAP_SYS_ADMIN is the most privileged capability and should always be avoided'
},
{
'selector': 'containers[] .securityContext .runAsNonRoot == true',
'reason': 'Force the running image to run as a non-root user to ensure least privilege'
},
// ...

Suggested Answer: A

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Rolf 11 months ago

Nice, but I’m skeptical about the scoring system.

Junita 11 months ago

I thought the default image was secure enough, guess not.

Lacresha 12 months ago

Wait, why is CAP_SYS_ADMIN even in there? That's risky!

Kimbery 12 months ago

Totally agree, readOnlyRootFilesystem is a must!

Viva 1 year ago

Just ran the scan, got a score of 4!

Felicitas 1 year ago

I definitely remember the importance of `readOnlyRootFilesystem`, but I hope I don't forget to check for other security settings like capabilities.

Augustine 1 year ago

I feel a bit uncertain about the exact command to run the scan. I know it involves `docker run`, but I might mix up the syntax.

Galen 1 year ago

I think we had a similar question about setting `runAsNonRoot` to improve security. I hope I can recall that detail.

Reynalda 1 year ago

I remember we practiced using kubesec to scan YAML files, but I'm not sure if I set the security context correctly last time.

Frank 1 year ago

This seems pretty straightforward. I'll give it a try and see if I can get the 4-point score.

Candida 1 year ago

No problem, I've used kubesec before. I'll just follow the steps in the question and make the necessary updates to the YAML to pass the scan.

Adela 1 year ago

Okay, I think I've got it. I'll scan the YAML, review the issues, and then update the manifest to address the advised changes. Hopefully, I can get a score of 4 points.

Lorenza 1 year ago

Hmm, I'm a bit confused about the hint. Do I need to run the kubesec image in a specific way to get the scan results?

Kizzy 1 year ago

This looks straightforward. I'll start by running the kubesec docker image to scan the YAML manifest and see what issues it identifies.

Sherron 1 year ago

Hmm, I'm a bit unsure about this one. There are a few options that seem relevant, but I'm not totally confident I know the best approach. I'll need to think it through carefully and make sure I understand the key considerations for this type of role.

Mertie 1 year ago

I remember a practice question where we discussed the necessity of attainments, which seems relevant here, too.

Gary 1 year ago

Hmm, I'm a bit unsure about this one. I know there are different types of power, but I can't quite remember which one is based on the manager's position. I'll have to think this through carefully.

Kenneth 1 year ago

Kubesec? More like Kube-awesome! This tool is going to make my life so much easier. Time to secure all the things!

Gregoria 1 year ago

↳ replying to Kenneth

User 3: Can't wait to see the improvements in our security scores!

Reid 1 year ago

↳ replying to Kenneth

User 2: Absolutely, it's going to help us secure our deployments better.

Colby 1 year ago

↳ replying to Kenneth

User 1: Kubesec is a game-changer for sure!

Royce 2 years ago

Wait, I need to run a container to scan the YAML file? That's a bit inconvenient. I hope there's an easier way to use this tool.

Lashonda 1 year ago

↳ replying to Royce

Once you get the hang of it, it becomes a quick process.

Paola 1 year ago

↳ replying to Royce

It may seem inconvenient, but it's an effective way to ensure security.

Valentin 1 year ago

↳ replying to Royce

You just need to run the docker command with the specified image.

Lavera 1 year ago

↳ replying to Royce

Yes, you can use the kubesec docker images to scan the YAML manifest.

Shaquana 2 years ago

Hmm, I wonder if the kubesec tool can also scan my Docker images for security vulnerabilities. That would be a nice bonus.

Sharen 2 years ago

Scanning the YAML manifest and applying the suggested changes seems straightforward. I'm confident I can get a score of 4 points.

Francis 2 years ago

I passed with a score of 4 points after making the changes.

Helga 2 years ago

I edited and applied the advised changes to the kubesec-test.yaml.

Francis 2 years ago

I found the kubesec docker images to scan the YAML manifest.

Johana 2 years ago

Yes, following the hints and making the necessary changes can help us pass with a good score.

Selene 2 years ago

The kubesec tool looks really useful for scanning and improving my Kubernetes manifests. I'll definitely give it a try.

Melissa 1 year ago

↳ replying to Selene

The kubesec tool is indeed helpful for enhancing Kubernetes manifest security.

Evette 1 year ago

↳ replying to Selene

I passed with a score of 4 points after making the advised changes.

Sharika 1 year ago

↳ replying to Selene

I edited the manifest based on the suggestions and rescanned it with kubesec.

Francine 1 year ago

↳ replying to Selene

I used the kubesec tool to scan my YAML manifest and got some suggestions for improving security.

Brock 2 years ago

I agree, it's important to edit and apply the advised changes to improve security.

Johana 2 years ago

I found the kubesec docker images very helpful for scanning the YAML manifest.

Linux Foundation CKS Exam - Topic 1 Question 46 Discussion