CKS killer.sh模拟环境设置

发表于2023-01-31|更新于2026-07-13|kubernetesCKS

|总字数:98|阅读时长:1分钟|浏览量:

预先设置环境变量, 提高效率

alias k=kubectl                         # kubectl 命令可以使用k代替
export do="--dry-run=client -o yaml"    # 导出yaml文件 可以用$do , 如 k create deploy nginx --image=nginx $do
export now="--force --grace-period 0"   # 强制 如:  k delete pod x $now

vim 设置

echo "ts=2 sw=2 et ai" >> ~/.vimrc
source ~/.vimrc

设置空格, tab,为2, tab为2空格, 换行自动对齐

文章作者: Hao

文章链接: https://www.hao.kim/archives/kubernetes/CKS/env-setting.html

版权声明: 本博客所有文章除特别声明外，均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来源 Hao DevSecOps！

K8s Killer.sh CKS

赞助

微信

相关推荐

CKS 模拟真题 Killer.sh | Question 11 | Secrets in ETCD

Task weight: 7% Use context: kubectl config use-context workload-prod There is an existing Secret called database-access in Namespace team-green . Read the complete Secret content directly from ETCD (using etcdctl ) and store it into /opt/course/11/etcd-secret-content . Write the plain and decoded Secret’s value of key “pass” into /opt/course/11/database-password . 译文任务权重：7%。使用环境：kubectl config use-context workload-prod 在命名空间 team-green 中有一个名为 data-access 的现有 Secret。直接从 ETCD 读取完整的 Secr...

CKS 题库 11、AppArmor

ContextAPPArmor 已在 cluster 的工作节点node02上被启用。一个 APPArmor 配置文件已存在，但尚未被实施。 Task在 cluster 的工作节点node02上，实施位于 /etc/apparmor.d/nginx_apparmor 的现有APPArmor 配置文件。编辑位于 /cks/KSSH00401/nginx-deploy.yaml 的现有清单文件以应用 AppArmor 配置文件。最后，应用清单文件并创建其中指定的 Pod 。请注意，考试时，考题里已表明APPArmor在工作节点上，所以你需要ssh到开头写的工作节点上。在模拟环境，你需要ssh到node02这个工作节点。参考https://kubernetes.io/zh/docs/tutorials/security/apparmor/#example 解答切换集群 kubectl config use-context KSSH00401 连接到 node02 并切换到 root ssh node02sudo -i 切换到 apparmor 目录, 并检查...

CKS 题库 5、日志审计 log audit

Task在cluster中启用审计日志。为此，请启用日志后端，并确保：日志存储在 /var/log/kubernetes/audit-logs.txt 日志文件能保留 10 天最多保留 2 个旧审计日志文件 /etc/kubernetes/logpolicy/sample-policy.yaml 提供了基本策略。它仅指定不记录的内容。注意：基本策略位于 cluster 的 master 节点上。编辑和扩展基本策略以记录： RequestResponse 级别的 persistentvolumes 更改 namespace front-apps 中 configmaps 更改的请求体 Metadata 级别的所有 namespace 中的 ConfigMap 和 Secret 的更改此外，添加一个全方位的规则以在 Metadata 级别记录所有其他请求。注意：不要忘记应用修改后的策略。参考https://kubernetes.io/zh/docs/tasks/debug/debug-cluster/audit/ 解答日志审计这一题需要自己调整的内...

CKS 模拟真题 Killer.sh | Question 8 | Secure Kubernetes Dashboard

Task weight: 3% Use context: kubectl config use-context workload-prod The Kubernetes Dashboard is installed in Namespace kubernetes-dashboard and is configured to: Allow users to “skip login” Allow insecure access (HTTP without authentication) Allow basic authentication Allow access from outside the cluster You are asked to make it more secure by: Deny users to “skip login” Deny insecure access, enforce HTTPS (self signed certificates are ok for now) Add the --auto-generate-certificates ar...

CKS 模拟真题 Killer.sh | Question 18 | Investigate Break-in via Audit Log

Task weight: 4% Use context: kubectl config use-context infra-prod Namespace security contains five Secrets of type Opaque which can be considered highly confidential. The latest Incident-Prevention-Investigation revealed that ServiceAccount p.auster had too broad access to the cluster for some time. This SA should’ve never had access to any Secrets in that Namespace. Find out which Secrets in Namespace security this SA did access by looking at the Audit Logs under /opt/course/18/audit.log ....

CKS 模拟真题 Killer.sh | Question 3 | Apiserver Security

Task weight: 3% Use context: kubectl config use-context workload-prod You received a list from the DevSecOps team which performed a security investigation of the k8s cluster1 ( workload-prod ). The list states the following about the apiserver setup: Accessible through a NodePort Service Change the apiserver setup so that: Only accessible through a ClusterIP Service 译文任务重量：3%。使用环境: kubectl config use-context workload-prod 你收到一份来自DevSecOps团队的清单，该团队对k8s cluster1（ workload-prod ）进行了安全调查。该清...

评论