Certified Kubernetes Security Specialist (CKS) #20 풀스케일 실기 모의고사: 16개 작업 + 해설

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

k apply -f deny.yaml
k -n payments get netpol

ssh cluster1-controlplane
sudo -i

vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --profiling=false
    - --insecure-port=0

crictl ps | grep kube-apiserver
kube-bench run --targets master

k delete clusterrolebinding ci-runner-admin

k -n dev create role ci-reader \
  --verb=get,list,watch \
  --resource=pods,deployments.apps
k -n dev create rolebinding ci-runner-read \
  --role=ci-reader \
  --serviceaccount=dev:ci-runner

k -n dev auth can-i list pods --as=system:serviceaccount:dev:ci-runner
k -n dev auth can-i delete pods --as=system:serviceaccount:dev:ci-runner

k -n legacy get pod report -o yaml > report.yaml

spec:
  automountServiceAccountToken: false
  containers:
    - name: report
      image: report:1.0

k -n legacy delete pod report
k apply -f report.yaml

k -n legacy exec report -- ls /var/run/secrets/kubernetes.io/serviceaccount

ssh node01
sudo -i

apparmor_parser -q /etc/apparmor.d/k8s-deny-write
aa-status | grep k8s-deny-write
exit

apiVersion: v1
kind: Pod
metadata:
  name: guarded
  namespace: apps
spec:
  containers:
    - name: web
      image: nginx
      securityContext:
        appArmorProfile:
          type: Localhost
          localhostProfile: k8s-deny-write

k apply -f guarded.yaml
k -n apps get pod guarded

apiVersion: v1
kind: Pod
metadata:
  name: seccomp-web
  namespace: apps
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: web
      image: nginx

k apply -f seccomp-web.yaml
k -n apps get pod seccomp-web

k -n apps edit deploy api

        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
            add:
              - NET_BIND_SERVICE

k -n apps rollout status deploy api
k -n apps get pod -l app=api -o jsonpath='{.items[0].spec.containers[0].securityContext}'

k label namespace restricted \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest

k -n restricted run rooty --image=nginx

apiVersion: v1
kind: Pod
metadata:
  name: compliant
  namespace: restricted
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: web
      image: nginx
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL

ssh cluster1-controlplane
sudo -i

vim /etc/kubernetes/enc/enc.yaml

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64로 인코딩한 32바이트 키>
      - identity: {}

    - --encryption-provider-config=/etc/kubernetes/enc/enc.yaml

k get secrets --all-namespaces -o json | kubectl replace -f -

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc
---
apiVersion: v1
kind: Pod
metadata:
  name: sandboxed
  namespace: apps
spec:
  runtimeClassName: gvisor
  containers:
    - name: web
      image: nginx

k apply -f gvisor.yaml
k -n apps get pod sandboxed

k -n apps set image deploy/legacy-app \
  legacy-app=gcr.io/distroless/nodejs18-debian12

k -n apps rollout status deploy legacy-app

k -n apps get deploy legacy-app -o jsonpath='{.spec.template.spec.containers[0].image}'

ssh cluster1-controlplane
sudo -i

trivy image --severity HIGH,CRITICAL nginx:1.21.0 > /opt/trivy-report.txt
cat /opt/trivy-report.txt

trivy image --severity CRITICAL --exit-code 1 nginx:1.21.0

cosign verify --key /opt/cosign.pub registry.local/web@sha256:abc...

k -n apps set image deploy/web web=registry.local/web@sha256:abc...

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-image-tag
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "이미지에 명시적 태그가 필요하며 latest는 금지됩니다."
        pattern:
          spec:
            containers:
              - image: "!*:latest"

k apply -f disallow-latest.yaml
k run probe --image=nginx:latest

ssh node01
sudo -i

vim /etc/falco/falco_rules.local.yaml

- rule: Shell in container
  desc: 컨테이너 안에서 셸 실행을 탐지합니다
  condition: >
    spawned_process and container
    and proc.name in (bash, sh)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.id command=%proc.cmdline)
  priority: WARNING

systemctl restart falco
journalctl -u falco -e | grep "Shell in container"

ssh cluster1-controlplane
sudo -i

vim /etc/kubernetes/audit/policy.yaml

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources:
          - secrets
  - level: Metadata

    - --audit-policy-file=/etc/kubernetes/audit/policy.yaml
    - --audit-log-path=/var/log/kubernetes/audit.log
    - --audit-log-maxage=30

crictl ps | grep kube-apiserver
tail -f /var/log/kubernetes/audit.log