mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

completed lesson 31

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-25 15:12:00 +06:00
parent f1b693a147
commit 73093b9328
7 changed files with 173 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
lab/lesson-31-answer.yaml Normal file
View File

@@ -0,0 +1,27 @@
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: security-admission
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiVersions: ["v1"]
apiGroups: [""]
operations: ["CREATE","UPDATE"]
resources: ["pods"]
validations:
- expression: "object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true) && (!has(object.spec.initContainers) || object.spec.initContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true))"
message: "Privileged regular and init containers are not allowed"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: security-admission-binding
spec:
policyName: security-admission
validationActions: [Deny]
matchResources:
namespaceSelector:
matchLabels:
cks-training: admission

11
lab/lesson-31-fixture.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: v1
kind: Namespace
metadata:
name: admission-lab
labels:
cks-training: admission
---
apiVersion: v1
kind: Namespace
metadata:
name: admission-control

7
lab/lesson-32-audit.jsonl Normal file
View File

@@ -0,0 +1,7 @@
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"b1","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:20:10Z","verb":"list","user":{"username":"system:serviceaccount:monitoring:collector"},"sourceIPs":["10.244.1.20"],"objectRef":{"resource":"pods","namespace":"checkout"},"responseStatus":{"code":200}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"b2","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:21:05Z","verb":"create","user":{"username":"system:serviceaccount:default:unknown"},"sourceIPs":["10.244.4.19"],"objectRef":{"apiGroup":"rbac.authorization.k8s.io","resource":"clusterrolebindings","name":"unknown-admin"},"responseStatus":{"code":403,"status":"Failure"}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"b3","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:22:11Z","verb":"create","user":{"username":"system:serviceaccount:checkout:release-bot"},"sourceIPs":["10.244.2.44"],"objectRef":{"apiGroup":"rbac.authorization.k8s.io","resource":"rolebindings","namespace":"checkout","name":"release-bot-secret-reader"},"responseStatus":{"code":201}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"b4","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:22:18Z","verb":"list","user":{"username":"system:serviceaccount:checkout:release-bot"},"sourceIPs":["10.244.2.44"],"objectRef":{"resource":"secrets","namespace":"checkout"},"responseStatus":{"code":200}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"b5","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:22:27Z","verb":"get","user":{"username":"system:serviceaccount:checkout:release-bot"},"sourceIPs":["10.244.2.44"],"objectRef":{"resource":"secrets","namespace":"checkout","name":"payment-gateway"},"responseStatus":{"code":200}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"b6","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:22:51Z","verb":"create","user":{"username":"system:serviceaccount:checkout:release-bot"},"sourceIPs":["10.244.2.44"],"objectRef":{"resource":"pods","subresource":"exec","namespace":"checkout","name":"checkout-api-6d8f"},"responseStatus":{"code":101}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"b7","stage":"ResponseComplete","requestReceivedTimestamp":"2026-08-25T04:24:00Z","verb":"get","user":{"username":"system:node:cks-worker"},"sourceIPs":["10.0.0.12"],"objectRef":{"resource":"nodes","name":"cks-worker"},"responseStatus":{"code":200}}