KSC preparaion

• Kubernetes Service Account
• API request
• Secrets
• cata-containers
• mTLS
• OPA
• footprint
• kubesec
• scanning
• supply-chain
• runtime-analyse
• immutability
• auditing
• kernel-hardering
• reduce-attack-surface

Simulator killer.sh https://killercoda.com/killer-shell-cks/scenario/apiserver-crash

Page for exam

• change encrypt
• • Don't forget mount /volume + VolumeMount
• • use echo -n -n to generate valid secret key
• • check errors by 'crictl ps' + api server manifest
• • reencrypt kubectl get secrets -n your-namespace -o json | kubectl replace -f -
• admission-controller
• • config files are personal and mounts inside container
• • Special config

...
kind: AdmissionConfiguration
...

• • Custom format: Config, especially server:

 server: https://images.example.com/policy # URL of remote service to query. Must use 'https'.

• NetworkPolicy
• • namespaceSelector works by LABELS, be
• • better use kubernetes.io/metadata.name label

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np
  namespace: space2
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        #matchLabels:
        # kubernetes.io/metadata.name: space1
        matchExpressions:
        - key: kubernetes.io/metadata.name #See this key
          operator: In
          values: ["space1", "backend"]