Linux Foundation CKS Dumps

[master@cli] $ cd /etc/Kubernetes/config1. Edit kubeconfig to explicity deny[master@cli] $ vim kubeconfig.json"defaultAllow": false                         # Change to false2. fix server parameter by taking its value from ~/.kube/config[master@cli] $cat /etc/kubernetes/config/kubeconfig.yaml | grep serverserver:3. Enable ImagePolicyWebhook[master@cli] $ vim /etc/kubernetes/manifests/kube-apiserver.yaml- --enable-admission-plugins=NodeRestriction,ImagePolicyWebhook                    # Add this- --admission-control-config-file=/etc/kubernetes/config/kubeconfig.json                # Add this

Explanation[desk@cli] $ ssh master[master@cli] $ cd /etc/Kubernetes/config[master@cli] $ vim kubeconfig.json

{

"imagePolicy": {

"kubeConfigFile": "/etc/kubernetes/config/kubeconfig.yaml",

"allowTTL": 50,

"denyTTL": 50,

"retryBackoff": 500,

"defaultAllow": true # Delete this

"defaultAllow": false # Add this

}

}

Text Description automatically generated[master@cli] $cat /etc/kubernetes/config/kubeconfig.yamlText Description automatically generated

Note: We can see a missing value here, so how from where i can get this value[master@cli] $cat ~/.kube/config | grep serveror[master@cli] $cat /etc/kubernetes/manifests/kube-apiserver.yaml

[master@cli] $vim /etc/kubernetes/config/kubeconfig.yaml

Text Description automatically generated

[controlplane@cli] $ k get pods -n nato -o yaml | grep "image: "[controlplane@cli] $ trivy image [controlplane@cli] $ k delete pod -n nato

[desk@cli] $ ssh controlnode[controlplane@cli] $ k get pods -n nato

NAME READY STATUS RESTARTS AGE

alohmora 1/1 Running 0 3m7s

c3d3 1/1 Running 0 2m54s

neon-pod 1/1 Running 0 2m11s

thor 1/1 Running 0 58s

[controlplane@cli] $ k get pods -n nato -o yaml | grep "image: "

Text Description automatically generated[controlplane@cli] $ trivy image Text Description automatically generatedText Description automatically generatedText Description automatically generatedNote: As there are 2 images have vulnerability with severity Hight & Critical. Delete containers for nginx:latest & alpine:3.7

[controlplane@cli] $ k delete pod thor -n nato