2 lines
4.1 KiB
HTML
2 lines
4.1 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 21: Pod Security Admission modes</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0021 · 40 minutes · Minimize Microservice Vulnerabilities</p><h1>Introduce restricted policy without losing visibility</h1><p class="lede">Pod Security Admission has three independent modes: enforce blocks a workload, audit records violations, and warn informs the requesting user. Mature rollouts often use all three during a migration.</p><div class="callout"><strong>Exam reflex:</strong> these are Namespace labels. Each mode needs its own label key and can use a different target level or version. Enforcement alone is not the whole rollout story.</div><h2>Timed task: 30 minutes</h2><p>Apply <code>lab/lesson-21-fixture.yaml</code>. Create <code>lab/lesson-21-answer.yaml</code> from scratch. Do not change the fixture.</p><p>Deliver a safe migration for namespace <code>partner-workloads</code>:</p><ul><li>Existing Pods must remain running.</li><li>New or updated Pods must be rejected unless they meet the <code>restricted</code> Pod Security Standard.</li><li>Violations must also be visible through audit and user-facing warnings at <code>restricted</code>.</li><li>Pin every mode to the Kubernetes minor version running in this cluster.</li><li>Create a compliant replacement Pod named <code>exporter-v2</code> in the same namespace, using image <code>busybox:1.37</code>, command <code>sh -c 'sleep 3600'</code>, and label <code>app=exporter</code>.</li></ul><p>The replacement must run as non-root UID <code>1000</code>, use RuntimeDefault seccomp, prevent privilege escalation, and drop all capabilities. Do not mount a ServiceAccount token. No starter Pod or namespace-label YAML is provided.</p><h2>Verification</h2><pre><code>kubectl --context kind-cks-lab version --output=yaml kubectl --context kind-cks-lab apply -f .\lab\lesson-21-fixture.yaml kubectl --context kind-cks-lab apply -f .\lab\lesson-21-answer.yaml kubectl --context kind-cks-lab -n partner-workloads get pod legacy-exporter exporter-v2 kubectl --context kind-cks-lab -n partner-workloads run rejected-test --image=busybox:1.37 --restart=Never -- sh -c 'sleep 60' kubectl --context kind-cks-lab get namespace partner-workloads --show-labels</code></pre><p>Expected: <code>legacy-exporter</code> remains running, <code>exporter-v2</code> is Ready, and <code>rejected-test</code> is denied. The final command must show six PSA labels: enforce, audit, and warn levels plus their three version labels.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Which Pod Security Admission mode blocks a non-compliant new Pod?</p><label><input type="radio" name="q" value="enforce">Enforce.</label><label><input type="radio" name="q" value="audit">Audit.</label><label><input type="radio" name="q" value="warn">Warn.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official Kubernetes <a href="https://kubernetes.io/docs/concepts/security/pod-security-admission/">Pod Security Admission</a> reference. Confirm the exact label names and version formatting instead of relying on memory.</p><h2>What to send me</h2><p>Paste your namespace and replacement-Pod YAML, plus the rejected admission message. I’ll check all three modes, version pinning, and workload compliance.</p><footer>Previous: <a href="0020-runtime-shell-detection.html">Runtime shell detection</a> · CKS domain: Minimize Microservice Vulnerabilities</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='enforce'){f.textContent='Correct. Enforce rejects non-compliant workloads; audit records and warn reports them.';f.className='feedback good';}else{f.textContent='Not quite. Only enforce prevents admission; audit and warn create visibility.';f.className='feedback bad';}}</script></body></html>
|