2 lines
3.8 KiB
HTML
2 lines
3.8 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 4: harden a workload</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0004 · 25 minutes</p><h1>Harden a workload without breaking it</h1><p class="lede">You already know how to write YAML. This drill trains the security-engineering question: which process-level privileges does this workload actually need?</p><div class="callout"><strong>Rule of thumb:</strong> every privilege you do not explicitly need is attack surface. Start restrictive, then add only what the workload demonstrably requires.</div><h2>The hardening controls</h2><ul><li><code>runAsNonRoot: true</code> and <code>runAsUser: 1000</code>: prevents the process from running as UID 0.</li><li><code>allowPrivilegeEscalation: false</code>: blocks gaining more privilege through mechanisms such as setuid binaries.</li><li><code>capabilities.drop: ["ALL"]</code>: removes Linux capabilities unless one is explicitly justified.</li><li><code>readOnlyRootFilesystem: true</code>: prevents writes to the image filesystem.</li><li><code>seccompProfile.type: RuntimeDefault</code>: applies the container runtime’s default syscall filter.</li></ul><p>Use the official <a href="https://kubernetes.io/docs/concepts/security/linux-kernel-security-constraints/">Linux kernel security constraints</a> and <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">SecurityContext task guide</a> if you need syntax or a deeper explanation.</p><h2>Timed task: 15 minutes</h2><p>The existing <code>inventory</code> pod in namespace <code>cks-workload</code> is intentionally insecure. Create <code>lab/workload-hardening-answer.yaml</code> that preserves the pod name, namespace, image, command, and label while adding every control from the list above.</p><ol><li>Inspect the current manifest: <code>kubectl --context kind-cks-lab -n cks-workload get pod inventory -o yaml</code>.</li><li>Write your replacement manifest from memory. The fast way to replace a Pod is <code>kubectl --context kind-cks-lab replace --force -f .\lab\workload-hardening-answer.yaml</code>.</li><li>Wait for it: <code>kubectl --context kind-cks-lab -n cks-workload wait --for=condition=Ready pod/inventory --timeout=60s</code>.</li><li>Verify identity: <code>kubectl --context kind-cks-lab -n cks-workload exec inventory -- id</code>. It must show a non-zero UID.</li></ol><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>A container needs no special kernel privilege. What is the secure default for Linux capabilities?</p><label><input type="radio" name="q" value="add"> Add NET_ADMIN for troubleshooting</label><label><input type="radio" name="q" value="drop"> Drop ALL capabilities</label><label><input type="radio" name="q" value="default"> Leave image defaults unchanged</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>What to send me</h2><p>Paste your YAML plus the output of <code>id</code>. I’ll verify the security context and show you one exam-speed inspection command.</p><footer>Previous: <a href="0003-rbac-least-privilege.html">RBAC least privilege</a> · Reference: <a href="../reference/cks-four-week-field-guide.html">CKS four-week field guide</a></footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='drop'){f.textContent='Correct. Drop ALL, then add back only a specifically required capability.';f.className='feedback good';}else{f.textContent='Not quite. Least privilege starts by dropping capabilities that are not explicitly required.';f.className='feedback bad';}}</script></body></html>
|