Linux Foundation CKS Practice Exam Questions & Answers

Explanation

1) Connect to the correct host

ssh cks000036

sudo -i

export KUBECONFIG=/etc/kubernetes/admin.conf

2) Confirm the failing Pods + see the PSA error (fast)

kubectl -n confidential get deploy

kubectl -n confidential get pods

kubectl -n confidential describe deploy <deployment-name> | sed -n '/Events/,$p'

(You'll usually see ''violates PodSecurity 'restricted' ...'' with the exact missing fields.)

3) Edit the provided manifest

vi /home/candidate/nginx-unprivileged.yaml

You must ensure the Pod template becomes compliant. Add/ensure the following exact blocks:

4) Add Pod-level securityContext (under spec.template.spec)

Find:

spec:

template:

spec:

Add this block under it (or merge if securityContext: already exists):

securityContext:

runAsNonRoot: true

runAsUser: 65535

seccompProfile:

type: RuntimeDefault

5) Add Container-level securityContext (under the nginx container)

Find:

containers:

- name: ...

image: ...

Under that container, add (or adjust) this exact block:

securityContext:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

capabilities:

drop:

- ALL

If there are multiple containers, apply the same container securityContext to each one.

Save and exit:

:wq

6) Apply the manifest to the confidential namespace

kubectl -n confidential apply -f /home/candidate/nginx-unprivileged.yaml

Wait rollout:

kubectl -n confidential rollout status deployment/<deployment-name>

If you don't know the deployment name from the file, list:

kubectl -n confidential get deploy

7) Verify Pods are running

kubectl -n confidential get pods -o wide

If still failing, show the exact PSA violation (this tells you what else to fix):

kubectl -n confidential describe pod | sed -n '/Events/,$p'

Quick ''if it still fails'' fixes (common restricted blockers)

Open the manifest again and ensure these are NOT set (or are removed/false):

hostNetwork: true

hostPID: true

hostIPC: true

any hostPort:

privileged: true

capabilities.add:

seccompProfile: Unconfined

runAsUser: 0 or runAsNonRoot: false

Then re-apply.

Minimal compliant result (what the grader expects)

Your Pod template should include:

seccompProfile: RuntimeDefault

runAsNonRoot: true (and a non-root UID like 65535)

container: allowPrivilegeEscalation: false

container: capabilities.drop: [ALL]

container: readOnlyRootFilesystem: true

Explanation To enable audit logs in Kubernetes, you need to configure the audit policy file and set parameters in the API server. The logs backend writes events to a file specified with the logPath parameter, set here to /var/log/kubernetes/kubernetes-logs.txt. Retention is controlled by maxAge (5 days) and maxBackup (10 files). The audit policy defines what gets logged and at what level. RequestResponse logs both request and response bodies, useful for sensitive resources like cronjobs and deployments in kube-system. The Request level logs the request body for other resources. Watch requests should be excluded to reduce noise in the logs.

Explanation

Below is the CKS exam style ''do-this-exactly'' runbook for Q3. It includes the minimal discovery commands (so you don't guess filenames), then the exact lines/blocks to set.

QUESTION 3 -- ImagePolicyWebhook (Validating Admission) -- Exam Steps

0) SSH + root

ssh cks000002

sudo -i

1) Identify the provided config files (no guessing)

ls -la /etc/kubernetes/bouncer

You are looking for files typically named like:

admission_configuration.yaml (AdmissionConfiguration)

imagepolicywebhook.yaml (ImagePolicyWebhookConfiguration) OR the ImagePolicyWebhook config embedded inside the AdmissionConfiguration

kubeconfig (webhook kubeconfig)

If unsure which is which, quick peek:

grep -R 'ImagePolicyWebhook' -n /etc/kubernetes/bouncer

grep -R 'AdmissionConfiguration' -n /etc/kubernetes/bouncer

grep -R 'kubeconfig' -n /etc/kubernetes/bouncer

PART A --- Reconfigure API Server to enable required admission plugin(s)

2) Edit API server static pod manifest

vi /etc/kubernetes/manifests/kube-apiserver.yaml

2.1 Enable the admission plugin ImagePolicyWebhook

Find the line starting with:

- --enable-admission-plugins=

Ensure ImagePolicyWebhook is included in that comma list.

Example (your list may differ; just add ImagePolicyWebhook):

- --enable-admission-plugins=NodeRestriction,ImagePolicyWebhook

If the flag does not exist, add one line under command::

- --enable-admission-plugins=ImagePolicyWebhook

2.2 Point API server to the provided AdmissionConfiguration

In the same file, ensure this flag exists (use the file in /etc/kubernetes/bouncer that contains AdmissionConfiguration):

- --admission-control-config-file=/etc/kubernetes/bouncer/admission_configuration.yaml

If your file is named differently, use the real filename you found in step 1, but keep the flag name exactly --admission-control-config-file.

Save/exit:

:wq

Static pod will restart automatically (kubelet watches the manifest).

Optional quick watch:

docker ps | grep kube-apiserver

# or:

crictl ps | grep kube-apiserver

PART B --- Configure ImagePolicyWebhook to deny images on backend failure

3) Edit the ImagePolicyWebhook config

One of these is true on your cluster:

Option 1 (most common in these tasks): ImagePolicyWebhook config is a standalone file

Edit the file in /etc/kubernetes/bouncer that contains kind: ImagePolicyWebhookConfiguration:

grep -R 'kind: ImagePolicyWebhookConfiguration' -n /etc/kubernetes/bouncer

vi /etc/kubernetes/bouncer/<THE_FILE_YOU_FOUND>.yaml

Set (or ensure) exactly:

defaultAllow: false

Option 2: ImagePolicyWebhook config is embedded inside AdmissionConfiguration

Edit the AdmissionConfiguration file:

vi /etc/kubernetes/bouncer/admission_configuration.yaml

Find the plugin section for ImagePolicyWebhook and ensure the config includes:

defaultAllow: false

Save/exit:

:wq

PART C --- Point backend configuration to https://smooth-yak.local/review

4) Edit the webhook kubeconfig to use the scanner endpoint

Find the kubeconfig file referenced by the ImagePolicyWebhook config.

Search for kubeConfigFile:

grep -R 'kubeConfigFile' -n /etc/kubernetes/bouncer

Open that kubeconfig path (example name below; yours may differ):

vi /etc/kubernetes/bouncer/kubeconfig

In kubeconfig, set the cluster server exactly:

clusters:

- cluster:

server: https://smooth-yak.local/review

Save/exit:

:wq

PART D --- Restart effect (make sure API server picks up config)

Because you already edited /etc/kubernetes/manifests/kube-apiserver.yaml, the API server restarted.

To be safe (and fast), force a restart by ''touching'' the manifest (no content change needed):

touch /etc/kubernetes/manifests/kube-apiserver.yaml

PART E --- Test: apply vulnerable workload and confirm it is denied

5) Use admin kubeconfig (because old kubectl config may break)

export KUBECONFIG=/etc/kubernetes/admin.conf

kubectl get nodes

6) Deploy the test resource (should be DENIED)

kubectl apply -f /home/candidate/vulnerable.yaml

Expected: admission error/denied message.

If it already exists:

kubectl delete -f /home/candidate/vulnerable.yaml

kubectl apply -f /home/candidate/vulnerable.yaml

PART F --- Verify the scanner was called (log check)

7) Check scanner access log

tail -n 50 /var/log/nginx/access_log

You should see requests hitting /review.

Quick ''what to check if it doesn't deny''

Run these in order:

Confirm API server flags:

grep -n 'enable-admission-plugins' /etc/kubernetes/manifests/kube-apiserver.yaml

grep -n 'admission-control-config-file' /etc/kubernetes/manifests/kube-apiserver.yaml

Confirm deny-on-failure:

grep -R 'defaultAllow' -n /etc/kubernetes/bouncer

Must show:

defaultAllow: false

Confirm endpoint:

grep -R 'server: https://smooth-yak.local/review' -n /etc/kubernetes/bouncer

API server logs (docker runtime):

docker ps | grep kube-apiserver

docker logs $(docker ps -q --filter name=kube-apiserver) --tail 80

If you paste the output of:

ls - /etc/kubernetes/bouncer

grep -R 'kind: AdmissionConfiguration' -n /etc/kubernetes/bouncer

grep -R 'ImagePolicyWebhook' -n /etc/kubernetes/bouncer

Explanation NetworkPolicy allows you to restrict traffic at the pod level within a Kubernetes cluster. The pod-access policy targets the users-service pod in the dev-team namespace and defines ingress rules specifying which pods can connect to it. You need to specify the source pods by their labels and optionally their namespaces. Without a NetworkPolicy, all pods can communicate with each other by default. The policy uses selectors to identify both the target pod and allowed source pods. This implements network segmentation and reduces lateral movement risk.

Explanation

1) SSH to control-plane node

ssh cks000002

sudo -i

2) Edit API Server static pod manifest

API server in kubeadm runs as a static pod.

vi /etc/kubernetes/manifests/kube-apiserver.yaml

3) Apply required API Server security settings

3.1 Forbid anonymous authentication

Find command: section and ensure this line exists:

- --anonymous-auth=false

3.2 Use authorization mode Node,RBAC

Ensure exactly this line exists (and no AlwaysAllow):

- --authorization-mode=Node,RBAC

Remove if present:

- --authorization-mode=AlwaysAllow

3.3 Enable admission controller NodeRestriction

Find --enable-admission-plugins and ensure NodeRestriction is included.

Correct example:

- --enable-admission-plugins=NodeRestriction

If other plugins already exist, append NodeRestriction, e.g.:

- --enable-admission-plugins=NamespaceLifecycle,ServiceAccount,NodeRestriction

4) Save file and let kubelet restart API server

Just save and exit (:wq)

Kubelet will automatically restart the API server pod.

5) Switch kubectl to secured config

Current kubectl will stop working after API server hardening.

export KUBECONFIG=/etc/kubernetes/admin.conf

Verify access:

kubectl get nodes

6) Remove insecure ClusterRoleBinding

Delete system:anonymous binding:

kubectl delete clusterrolebinding system:anonymous

Verify removal:

kubectl get clusterrolebinding | grep anonymous

(no output = correct)

7) Quick validation (optional but fast)

API server flags check:

grep -n 'anonymous-auth' /etc/kubernetes/manifests/kube-apiserver.yaml

grep -n 'authorization-mode' /etc/kubernetes/manifests/kube-apiserver.yaml

grep -n 'NodeRestriction' /etc/kubernetes/manifests/kube-apiserver.yaml

Explanation

Install the Runtime Class for gVisor

{ # Step 1: Install a RuntimeClass

cat <<EOF | kubectl apply -f -

apiVersion: node.k8s.io/v1beta1

kind: RuntimeClass

metadata:

name: gvisor

handler: runsc

EOF

}

Create a Pod with the gVisor Runtime Class

{ # Step 2: Create a pod

cat <<EOF | kubectl apply -f -

apiVersion: v1

kind: Pod

metadata:

name: nginx-gvisor

spec:

runtimeClassName: gvisor

containers:

- name: nginx

image: nginx

EOF

}

Verify that the Pod is running

{ # Step 3: Get the pod

kubectl get pod nginx-gvisor -o wide

}

Explanation RuntimeClass provides a way to run pods with different runtime handlers instead of the default container runtime. You create a RuntimeClass resource specifying the handler name, then reference it in the pod specification. In this case, the gVisor runtime handler provides additional security isolation at the container level. gVisor intercepts syscalls and implements a sandbox, reducing the kernel attack surface. This is useful for running untrusted workloads. The pod references the RuntimeClass by name in its spec.runtimeClassName field.