CKA - Security
___ lets you look at and possibly modify the requests that are coming in, and do a final
deny/accept the requests - correct answer-Admission Control.
Admission Controllers will check the actual content of the objects being created and validate
them before admitting the request
How can you secure your pods? - correct answer-Using secuity context and Pod Security
Policies (PSPs)
To perform ANY action in K8S cluster, you need to access the - correct answer-API Server
Each request to K8S API Server, goes through __ steps - correct answer-Three: AuthN,
AuthZ, Admission Control
The requests reaching the API Server are encrypted using ___ - correct answer-TLS.
AuthN in K8S is done via - correct answer-Basic: certificates, tokens or baisc authn
(username/passwd)
Adv: Webhooks, OpenID
(T/F) Users are created by the API Server - correct answer-False. Users should be managed
by external systems
___ are used by processes to access the API - correct answer-Service Accounts
AuthN mechanism in K8S is specified by ___ - correct answer-The type of authn is defined
in the kube-apiserver options.
API Server flag to specify Basic Authn - correct answer---basic-auth-file
Is the order of the configured authN modules evaluation guaranteed? - correct answer-No
Can Anonymous access be enabled ? - correct answer-Yes
Status code for unauthorized access - correct answer-401
Once a request is authenticated successfully, it will be ___ - correct answer-authorized
Different authZ modes - correct answer-ABAC, RBAC, Webhook
Flag to specify authorization mode to API Server - correct
answer---authorization-mode=ABAC,RBAC,Webhook,AlwaysDeny,AlwaysAllow
, How does authz plugins work? - correct answer-they implement policies to allow requests.
Attributes of the requests are checked against the policies (eg user, group, ns, verb)
All resources in K8S are .... - correct answer-modeled API objects
RBAC process - correct answer-1. Determine/create ns
2. create cert credentials for user
3. set the creds for the user to the ns using a context
4. create a role for the expected task set
5 Bind the user to the role
6. Verify the user has limited access
What happens in Webhook? - correct answer-A Webhook is an HTTP callback, an HTTP
POST that occurs when something happens; a simple event-notification via HTTP POST. A
web application implementing Webhooks will POST a message to a URL when certain
things happen.
What are Admission controllers? - correct answer-Pieces of software that can access the
content of the objects being created by the requests. They can modify the content or validate
it, and potentially deny the request.
Where are Admission Controllers present? - correct answer-Starting with 1.13.1, they are
compiled into the binary
specify admission controllers to APIServer - correct
answer---enable-admission-plugins=Initializers,NamespaceLifeCycle,LimitRanger
--disable-admission-plugins=PodNodeSelector
__ admission controller ensures that the object created does not violated any of the existing
quotas - correct answer-ResourceQuota
__ admission controller allows the dynamic modifications of the API requests - correct
answer-Initializers
the processes running in containers capabilities can be controlled by ... - correct
answer-security contexts
PSP(Pod Security Policies) are for? - correct answer-To automate the enforcement of
security contexts. These "policies" are cluster level rules that govern what a pod can do,
what they can access, what user they run as, etc
how do you prevent containers from being "privileged" - correct answer-define a PSP
how do you prevent containers from using the host network - correct answer-define a PSP
How are PSP's enabled? - correct answer-Need to configure the Admission Controller of the
controller-manger to contain PSP
___ lets you look at and possibly modify the requests that are coming in, and do a final
deny/accept the requests - correct answer-Admission Control.
Admission Controllers will check the actual content of the objects being created and validate
them before admitting the request
How can you secure your pods? - correct answer-Using secuity context and Pod Security
Policies (PSPs)
To perform ANY action in K8S cluster, you need to access the - correct answer-API Server
Each request to K8S API Server, goes through __ steps - correct answer-Three: AuthN,
AuthZ, Admission Control
The requests reaching the API Server are encrypted using ___ - correct answer-TLS.
AuthN in K8S is done via - correct answer-Basic: certificates, tokens or baisc authn
(username/passwd)
Adv: Webhooks, OpenID
(T/F) Users are created by the API Server - correct answer-False. Users should be managed
by external systems
___ are used by processes to access the API - correct answer-Service Accounts
AuthN mechanism in K8S is specified by ___ - correct answer-The type of authn is defined
in the kube-apiserver options.
API Server flag to specify Basic Authn - correct answer---basic-auth-file
Is the order of the configured authN modules evaluation guaranteed? - correct answer-No
Can Anonymous access be enabled ? - correct answer-Yes
Status code for unauthorized access - correct answer-401
Once a request is authenticated successfully, it will be ___ - correct answer-authorized
Different authZ modes - correct answer-ABAC, RBAC, Webhook
Flag to specify authorization mode to API Server - correct
answer---authorization-mode=ABAC,RBAC,Webhook,AlwaysDeny,AlwaysAllow
, How does authz plugins work? - correct answer-they implement policies to allow requests.
Attributes of the requests are checked against the policies (eg user, group, ns, verb)
All resources in K8S are .... - correct answer-modeled API objects
RBAC process - correct answer-1. Determine/create ns
2. create cert credentials for user
3. set the creds for the user to the ns using a context
4. create a role for the expected task set
5 Bind the user to the role
6. Verify the user has limited access
What happens in Webhook? - correct answer-A Webhook is an HTTP callback, an HTTP
POST that occurs when something happens; a simple event-notification via HTTP POST. A
web application implementing Webhooks will POST a message to a URL when certain
things happen.
What are Admission controllers? - correct answer-Pieces of software that can access the
content of the objects being created by the requests. They can modify the content or validate
it, and potentially deny the request.
Where are Admission Controllers present? - correct answer-Starting with 1.13.1, they are
compiled into the binary
specify admission controllers to APIServer - correct
answer---enable-admission-plugins=Initializers,NamespaceLifeCycle,LimitRanger
--disable-admission-plugins=PodNodeSelector
__ admission controller ensures that the object created does not violated any of the existing
quotas - correct answer-ResourceQuota
__ admission controller allows the dynamic modifications of the API requests - correct
answer-Initializers
the processes running in containers capabilities can be controlled by ... - correct
answer-security contexts
PSP(Pod Security Policies) are for? - correct answer-To automate the enforcement of
security contexts. These "policies" are cluster level rules that govern what a pod can do,
what they can access, what user they run as, etc
how do you prevent containers from being "privileged" - correct answer-define a PSP
how do you prevent containers from using the host network - correct answer-define a PSP
How are PSP's enabled? - correct answer-Need to configure the Admission Controller of the
controller-manger to contain PSP
