Completed upto lesson 28

lab/lesson-27-answer.md

@@ -0,0 +1,61 @@
+docker run --rm -v "${PWD}:/work" aquasec/trivy:0.68.1 config /work/lab/lesson-27-fixture.yaml
+
+
+
+AVD-KSV-0014 (HIGH): Container 'api' of Deployment 'checkout-api' should set 'securityContext.readOnlyRootFilesystem' to true
+════════════════════════════════════════
+────────────────────────────────────────
+ lesson-27-fixture.yaml:21-28
+────────────────────────────────────────
+  21 ┌       containers:
+  22 │         - name: api
+  23 │           image: nginx:latest
+  24 │           ports:
+  25 │             - containerPort: 8080
+  26 │           securityContext:
+  27 │             privileged: true
+  28 └             capabilities:
+────────────────────────────────────────
+explanation: rootFileSystem not readOnly so if the attacker gains access the the pod it can change the root directory
+remedy: enable readOnlyRootFilesystem in container security context
+
+
+AVD-KSV-0017 (HIGH): Container 'api' of Deployment 'checkout-api' should set 'securityContext.privileged' to false
+════════════════════════════════════════
+
+────────────────────────────────────────
+ lesson-27-fixture.yaml:21-28
+────────────────────────────────────────
+  21 ┌       containers:
+  22 │         - name: api
+  23 │           image: nginx:latest
+  24 │           ports:
+  25 │             - containerPort: 8080
+  26 │           securityContext:
+  27 │             privileged: true
+  28 └             capabilities:
+────────────────────────────────────────
+
+explanation: allow hacker to get privilege escalation inside the pod if the pod can get service token then it can hack the kubernetes system
+remedy: privileged: false
+
+AVD-KSV-0118 (HIGH): deployment checkout-api in checkout namespace is using the default security context, which allows root privileges
+════════════════════════════════════════
+
+────────────────────────────────────────
+ lesson-27-fixture.yaml:19-28
+────────────────────────────────────────
+  19 ┌         app: checkout-api
+  20 │     spec:
+  21 │       containers:
+  22 │         - name: api
+  23 │           image: nginx:latest
+  24 │           ports:
+  25 │             - containerPort: 8080
+  26 │           securityContext:
+  27 │             privileged: true
+  28 └             capabilities:
+────────────────────────────────────────
+
+explanation: allow hacker to get privilege escalation inside the pod if the pod can get service token then it can hack the kubernetes system
+remedy: runAsNonRoot: true