Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Kubernetes Administrators Certification (CKA) > Security > Flashcards

Security Flashcards

1
Q

v What is the command to create a service account?

A

k create serviceaccount <username></username>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What component provides authorization for users?

A

kube-apiserver

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 4 options for authorization?

A
  • Static Password File
  • Static Token File
  • Certificates
  • 3rd party Identity Services (such as LDAP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Where do you add the flag/option for specifying a static password file and what is the flag/option? (THIS IS NOT RECOMMENDED IN A PROD ENV)

A

You specify the static password file in the kube-apiserver.service or in the manifest in the spec section with with the –basic-auth-file=<filename></filename>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where do you add the flag/option for specifying a static password file and what is the flag/option? (THIS IS NOT RECOMMENDED IN A PROD ENV)

A

You specify the static password file in the or in the manifest in the spec section with with the –basic-auth-file=<filename></filename>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What command will show you all the certificates used by the kube-apiserver?

A

cat /etc/kubernetes/manifests/kube-apiserver.yaml

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What command checks the content of a certificate?

A

openssl x509 -in /etc/kubrenetes/pki/apiserver.crt -text -noout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What command generates kets for the CA?

A

openssl genrsa -out ca.key 2048

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the command to create a CSR for the CA?

A

openssl req -new -key ca.key -subj :/CN=KUBERNETES-CA” -out ca.csr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What command signs certificates for the CA?

A

openssl x509 -req -in ca.csr signkey ca.key -out ca.crt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What command creates a CSR for an admin user?

A

openssl req -new -key admin.key -subj :/CN=kube-admin/O=system:masters” -out admin.csr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What command signs a CSR for an admin user?

A

openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -out admin.crt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the names that are specified on the kube-apiserver certificate?

A

kubernetes
kubernetes.default
kubernetes.default.svc
kubernetes.default.svc.cluster.local
10.96.0.1
172.17.0.87

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the steps to adding new users via the certificates API?

A
  1. Create CertificateSigningRequest Object
  2. Review Requests
  3. Approve Requests
  4. Share Certs to Users
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the openssl command to generate a key for a new user?

A

openssl genrsa -out <user>.key 2048</user>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the openssl command to generate a cert for a new user?

A

openssl req -new -key <user>.key -subj "/CN=<user>" -out <user>.csr</user></user></user>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the command for an admin to see all CSR requests?

A

k get csr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the attributes of a CSR definition file?

A

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: akshay
spec:
groups:
- system:authenticated
request: <Paste>
signerName: kubernetes.io/kube-apiserver-client
usages:
- client auth</Paste>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the command to approve a csr request?

A

kubectl certificate approve <user></user>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the command to get a user certificate?

A

k get csr <user> -o yaml under status.certificate and to decript: echo "xxx" | base64 --decode</user>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the command to view the kubeconfig file?

A

k config view

or

k config view –kubeconfig=<filename></filename>

22
Q

What is the command to change context?

A

k config use-context <context_name></context_name>

23
Q

What is the name of the api group that is responsible for namespaces, pods, rc, events, endpoints, nodes, bindings, PV, PVC, configmaps, secrets, services?

A

core

24
Q

What are some examples of named APIs?

A

apps/
extensions/
networking.k8s.io/
storage.k8s.io/
authentication.k8s.io/
certificates.k8s.io/

25
Q

What are some examples of verbs under the named group for apps/v1/deployments?

A

get
list
create
delete
update
watch

26
Q

What is a command to list the named APIs?

A

curl http://localhost:6443 -k

You must use the:
k proxy

27
Q

What are the read permissions for node authorizer?

A

read: services, endpoints, nodes, pods

28
Q

What are the write permissions for node authorizer?

A

write: node status, pod status, events

29
Q

What are the different authorization-mode options?

A

–authorization-mode=Node,RBAC,Webhook

30
Q

What happens when an option specified in –authorization-mode denies a request?

A

If the first one deny the request, it will move to the next one

31
Q

What are the 3 parameters that are needed for setting rules in a Role definition file?

A

apiGroups, resources, verbs

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: pod-reader
rules:
- apiGroups: [””] # “” indicates the core API group
resources: [“pods”]
verbs: [“get”, “watch”, “list”]
- apiGroups: [””]
resources: [“ConfigMap”]
verbs: [“create”]

32
Q

How do you link a user to a role?

A

Create a role binding definition file.

apiVersion: rbac.authorization.k8s.io/v1
# This role binding allows “jane” to read pods in the “default” namespace.
# You need to already have a Role named “pod-reader” in that namespace.
kind: RoleBinding
metadata:
name: read-pods-binding
namespace: default
subjects:
# You can specify more than one “subject”
- kind: User
name: jane # “name” is case sensitive
apiGroup: rbac.authorization.k8s.io
roleRef:
# “roleRef” specifies the binding to a Role / ClusterRole
kind: Role #this must be Role or ClusterRole
name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
apiGroup: rbac.authorization.k8s.io

33
Q

What is the command to list the roles?

A

kubectl get roles

34
Q

What is the command to list role bindings?

A

kubectl get rolebindings

35
Q

What is the command to see details about a role binding?

A

kubectl describe role read-pods-binding

36
Q

What is the command to see if you have access to an action?

A

kubectl auth can-i delete pods

37
Q

What is the command to see if a user has access to an action?

A

kubectl auth can-i create deployments –as dev-user –namespace test

38
Q

What are the namespaced scoped resources?

A

pods
replicasets
jobs
deployments
services
secrets
roles
rolebindings
configmaps
pvc

39
Q

What are the cluster scoped resources?

A

nodes
pv
clusterroles
clusterrolebindings
certificatesigningrequests
namespaces

40
Q

Can a cluster role be used for namespaced resources?

A

ClusterRole can be used for namespaced resources but will then be generic to all namespaces.

41
Q

What is the command to create a service account?

A

kubectl create serviceaccount <name></name>

42
Q

What command lists service accounts?

A

k get serviceaccount

43
Q

What command explains service accounts?

A

k describe serviceaccount <service_account_name></service_account_name>

44
Q

What command shows details about the service account’s token?

A

k describe secret <service_account_token_name></service_account_token_name>

45
Q

What is the command to create a private container repository?

A

kubectl create secret docker-registry regcred \
–docker-server=private-registry.io \
–docker-username=registry-user \
–docker-password=registry-password \
–docker-email=registry-user@org.com

46
Q

Capabilities are only available at what level?

A

Container level

47
Q

Container level security context overrides what level of security context?

A

The pod level

48
Q

What spec configuration sets security capabilities?

A

securityContext:

Example 1 –>
apiVersion: v1
kind: Pod
metadata:
name: web-pod
spec:
containers:
- image: ubuntu
name: ubuntu
command: [“sleep”, “3600”]
securityContext:
runAsUser: 1000

Example 2 –>
apiVersion: v1
kind: Pod
metadata:
name: web-pod
spec:
containers:
- image: ubuntu
name: ubuntu
command: [“sleep”, “3600”]
securityContext:
runAsUser: 1000
capabilities:
add: [“MAC_ADMIN”]

49
Q

What is the default network communication policy for pods?

A

By default every pod can communicate to every pod or services within the cluster.

50
Q

How do you assign a network policy to a pod?

A

Create a network policy definition, and assign using labels and selectors.

Certified Kubernetes Administrators Certification (CKA) (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions