Discuss Linux Foundation CKS Exam Topic 4 Question 74

Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.

Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim.

Create a new ServiceAccount named psp-sa in the namespace restricted.

Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent-volume-policy

Create a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp-role to the created SA psp-sa.

Hint:

Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.

POD Manifest:

apiVersion: v1

kind: Pod

metadata:

name:

spec:

containers:

- name:

image:

volumeMounts:

- name:

mountPath:

volumes:

- name:

secret:

secretName:

AExplanation:
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
privileged: false
# Required to prevent escalations to root.
allowPrivilegeEscalation: false
# This is redundant with non-root + disallow privilege escalation,
# but we can provide it for defense in depth.
requiredDropCapabilities:
- ALL
# Allow core volume types.
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
# Assume that persistentVolumes set up by the cluster admin are safe to use.
- 'persistentVolumeClaim'
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
# Require the container to run without root privileges.
rule: 'MustRunAsNonRoot'
seLinux:
# This policy assumes the nodes are using AppArmor rather than SELinux.
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
readOnlyRootFilesystem: false

Suggested Answer: A

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Melinda 11 months ago

I thought secrets were essential for pods? Why can't we use them?

Lynda 11 months ago

Nice, this should help tighten security in the namespace.

Jade 12 months ago

Wait, can we really block all other volume types? Seems extreme.

Janessa 12 months ago

Totally agree, this is a solid restriction.

Alyce 1 year ago

Just a reminder, only persistentVolumeClaim is allowed here!

Alesia 1 year ago

I recall testing the configuration by trying to mount a secret, but I’m not sure if the pod manifest needs to be structured a certain way for that to work.

Amie 1 year ago

I’m a little confused about the annotations in the PSP. Do we need to include both seccomp and apparmor settings, or can we skip one?

Rory 1 year ago

I practiced a similar question where we had to create a ServiceAccount and bind it to a role, so I feel confident about that part, but the specifics of the policy are a bit fuzzy.

Jerlene 1 year ago

I think I remember that we need to define the PodSecurityPolicy with the right volume types, but I'm not entirely sure how to restrict it just to persistentvolumeclaim.

Mattie 1 year ago

The hint at the end is a good way to verify the configuration is working as expected. I'll make sure to try that out once I've set everything up.

Brett 1 year ago

Okay, I think I got this. First, create the PodSecurityPolicy to only allow the persistentvolumeclaim volume type. Then, create the ClusterRole and ClusterRoleBinding to associate it with the ServiceAccount. Should be able to test it by trying to mount a Secret volume.

Diane 1 year ago

Hmm, not sure about the details of the Pod Security Policy and how to restrict the volume types. Might need to review the documentation carefully.

Marta 1 year ago

This looks like a pretty straightforward task, just need to create the required resources and configure them properly.

Tricia 1 year ago

I bet the secret volume type will still try to sneak in, like a secret agent in a spy movie. Gotta watch out for that!

Walker 1 year ago

↳ replying to Tricia

User 3: Yeah, like a secret agent trying to sneak in a secret volume type.

Arlen 1 year ago

↳ replying to Tricia

User 2: Nice, that should prevent any unauthorized volumes from sneaking in.

Major 1 year ago

↳ replying to Tricia

User 1: I set up the PodSecurityPolicy to only allow persistentvolumeclaim as the volume type.

Timothy 1 year ago

Wait, so I have to create a whole new ServiceAccount, ClusterRole, and ClusterRoleBinding just to restrict the volume type? Seems a bit overkill, but I'll give it a shot.

Lorenza 2 years ago

Hold on, does this mean I can't use any other volume types besides persistentVolumeClaim? That could be tricky for some of my applications.

Diane 1 year ago

↳ replying to Lorenza

Make sure to check the logs for any errors when trying to mount a Secret. This restriction may require some adjustments in your application setup.

Diane 1 year ago

↳ replying to Lorenza

You can try to mount a Secret in the pod manifest to test if the configuration is working. It should fail since only persistentVolumeClaim is allowed.

Diane 1 year ago

↳ replying to Lorenza

Yes, that's correct. The PodSecurityPolicy you created only allows the use of persistentVolumeClaim as the volume type in the restricted namespace.

Janet 2 years ago

Hmm, creating a PodSecurityPolicy to restrict the volume type seems like a good approach. Let me review the details carefully.

Jacinta 1 year ago

↳ replying to Janet

And don't forget to create a ClusterRoleBinding to bind the ClusterRole to the ServiceAccount.

Estrella 1 year ago

↳ replying to Janet

We also need to create a new ServiceAccount named psp-sa in the restricted namespace.

Cherri 1 year ago

↳ replying to Janet

Yes, and it should prevent pods from using volumes other than persistentvolumeclaim.

Hillary 1 year ago

↳ replying to Janet

I think we need to create a new PodSecurityPolicy named prevent-volume-policy.

Ruthann 2 years ago

The question is clear and the steps are well-defined. I think I can handle this.

Vincent 1 year ago

↳ replying to Ruthann

After that, I will create the ServiceAccount named psp-sa in the restricted namespace.

Trinidad 1 year ago

↳ replying to Ruthann

I will start by creating the PodSecurityPolicy named prevent-volume-policy.

Jenifer 2 years ago

I think we should focus on creating the PodSecurityPolicy first.

Van 2 years ago

I agree, we need to carefully follow the instructions.

Yuki 2 years ago

This question seems tricky.

Linux Foundation CKS Exam - Topic 4 Question 74 Discussion