Config - Security Kontext

Question 1

At what levels can security be configured in Kubernetes in regards to containers?

Answer 1

• container level
• pod level

Question 2

How far do pod-level configurations reach?

Answer 2

• to all containers running in the pod

Question 3

What happens if security configurations are set at container and pod level?

Answer 3

• container level overwrites the pod level

Question 4

How do you configure security context on a pod-level ?

Answer 4

pod Yaml
~~~
apiVersion
kind
metadata
spec:
securityContext:
runAsUser: 1000
containers:
- name: ubuntu
image: ubuntu
command: [“sleep”, “3600”]
~~~

Question 5

How do you configure security context on a container-level ?

Answer 5

pod Yaml
~~~
apiVersion
kind
metadata
spec:

containers:
- name: ubuntu
image: ubuntu
command: [“sleep”, “3600”]
securityContext:
runAsUser: 1000
capabilities:
add: [“MAC_ADMIN”]
~~~
- Capabilities are only supported on the containter-level NOT pod-level

Question 6

With what command can you find out what user a pod is running as?

Answer 6

kubectl exec ubuntu-sleeper – whoami

Question 7

What does the ‘kubectl exec’ command start?

Answer 7

• enables to run a command in a specified container