{"id":154,"date":"2022-05-04T03:20:28","date_gmt":"2022-05-04T03:20:28","guid":{"rendered":"https:\/\/blog.topexamcollection.com\/?p=154"},"modified":"2022-05-04T03:20:28","modified_gmt":"2022-05-04T03:20:28","slug":"may-2022-pass-linux-foundation-cks-tests-engine-pdf-all-free-dumps-q10-q26","status":"publish","type":"post","link":"https:\/\/blog.topexamcollection.com\/de\/2022\/05\/may-2022-pass-linux-foundation-cks-tests-engine-pdf-all-free-dumps-q10-q26\/","title":{"rendered":"[May-2022] Pass Linux Foundation CKS Tests Engine pdf &#8211; All Free Dumps [Q10-Q26]"},"content":{"rendered":"\n\n<div class=\"kk-star-ratings kksr-auto kksr-align-left kksr-valign-top\"\n    data-payload='{&quot;align&quot;:&quot;left&quot;,&quot;id&quot;:&quot;154&quot;,&quot;slug&quot;:&quot;default&quot;,&quot;valign&quot;:&quot;top&quot;,&quot;ignore&quot;:&quot;&quot;,&quot;reference&quot;:&quot;auto&quot;,&quot;class&quot;:&quot;&quot;,&quot;count&quot;:&quot;0&quot;,&quot;legendonly&quot;:&quot;&quot;,&quot;readonly&quot;:&quot;&quot;,&quot;score&quot;:&quot;0&quot;,&quot;starsonly&quot;:&quot;&quot;,&quot;best&quot;:&quot;5&quot;,&quot;gap&quot;:&quot;5&quot;,&quot;greet&quot;:&quot;Rate this post&quot;,&quot;legend&quot;:&quot;0\\\/5 - (0 votes)&quot;,&quot;size&quot;:&quot;24&quot;,&quot;title&quot;:&quot;[May-2022] Pass Linux Foundation CKS Tests Engine pdf - All Free Dumps [Q10-Q26]&quot;,&quot;width&quot;:&quot;0&quot;,&quot;_legend&quot;:&quot;{score}\\\/{best} - ({count} {votes})&quot;,&quot;font_factor&quot;:&quot;1.25&quot;}'>\n            \n<div class=\"kksr-stars\">\n    \n<div class=\"kksr-stars-inactive\">\n            <div class=\"kksr-star\" data-star=\"1\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"2\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"3\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"4\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"5\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n    <\/div>\n    \n<div class=\"kksr-stars-active\" style=\"width: 0px;\">\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n    <\/div>\n<\/div>\n                \n\n<div class=\"kksr-legend\" style=\"font-size: 19.2px;\">\n            <span class=\"kksr-muted\">Rate this post<\/span>\n    <\/div>\n    <\/div>\n<p><span style=\"font-size: 18px\"><strong><span style=\"color: red\">[May-2022] Pass Linux Foundation CKS Tests Engine pdf &#8211; All Free Dumps<\/span><\/strong><\/span><\/p>\n<p><strong><span style=\"color: red\">Certified Kubernetes Security Specialist (CKS) Practice Tests 2022 | Pass CKS with confidence!<\/span><\/strong><\/p>\n<div id=\"watu_quiz\" class=\"quiz-area single-page-quiz\">\n<form action=\"\" method=\"post\" class=\"quiz-form \" id=\"quiz-76\" >\n<div class='watu-question' id='question-1'><div class='question-content'><p><strong>NO.10<\/strong> SIMULATION<br \/>use the Trivy to scan the following images,<br \/>1. amazonlinux:1<br \/>2. k8s.gcr.io\/kube-controller-manager:v1.18.6<br \/>Look for images with HIGH or CRITICAL severity vulnerabilities and store the output of the same in \/opt\/trivy-vulnerable.txt<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1476' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5758' \/><div class='watu-question-choice'><input type='radio' name='answer-1476[]' id='answer-id-5758' class='answer answer-1 php-answer-label answerof-1476' value='5758' \/>&nbsp;<label for='answer-id-5758' id='answer-label-5758' class='php-answer-label answer label-1'><span class='answer'>Send us the Feedback on it.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(1,this)' id='btn-1' value='See Answer'  \/><input type='hidden' id='questionType1' value='radio' class=''><\/div><div class='watu-question' id='question-2'><div class='question-content'><p><strong>NO.11<\/strong> SIMULATION<br \/>Given an existing Pod named test-web-pod running in the namespace test-system Edit the existing Role bound to the Pod&#8217;s Service Account named sa-backend to only allow performing get operations on endpoints.<br \/>Create a new Role named test-system-role-2 in the namespace test-system, which can perform patch operations, on resources of type statefulsets.<br \/>Create a new RoleBinding named test-system-role-2-binding binding the newly created Role to the Pod&#8217;s ServiceAccount sa-backend.<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1477' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5759' \/><div class='watu-question-choice'><input type='radio' name='answer-1477[]' id='answer-id-5759' class='answer answer-2 php-answer-label answerof-1477' value='5759' \/>&nbsp;<label for='answer-id-5759' id='answer-label-5759' class='php-answer-label answer label-2'><span class='answer'>Send us your feedback on this.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(2,this)' id='btn-2' value='See Answer'  \/><input type='hidden' id='questionType2' value='radio' class=''><\/div><div class='watu-question' id='question-3'><div class='question-content'><p><strong>NO.12<\/strong> You must complete this task on the following cluster\/nodes: Cluster: immutable-cluster Master node: master1 Worker node: worker1 You can switch the cluster\/configuration context using the following command:<br \/>[desk@cli] $ kubectl config use-context immutable-cluster<br \/>Context: It is best practice to design containers to be stateless and immutable.<br \/>Task:<br \/>Inspect Pods running in namespace prod and delete any Pod that is either not stateless or not immutable.<br \/>Use the following strict interpretation of stateless and immutable:<br \/>1. Pods being able to store data inside containers must be treated as not stateless.<br \/>Note: You don&#8217;t have to worry whether data is actually stored inside containers or not already.<br \/>2. Pods being configured to be privileged in any way must be treated as potentially not stateless or not immutable.<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1478' \/><textarea name='answer-1478[]' rows='5' cols='40' id='textarea_q_1478' class='watu-textarea watu-textarea-3'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>k get pods -n prod<br\/>k get pod &lt;pod-name&gt; -n prod -o yaml | grep -E &#8216;privileged|ReadOnlyRootFileSystem&#8217; Delete the pods which do have any of these 2 properties privileged:true or ReadOnlyRootFileSystem: false<br\/>[desk@cli]$ k get pods -n prod<br\/>NAME READY STATUS RESTARTS AGE<br\/>cms 1\/1 Running 0 68m<br\/>db 1\/1 Running 0 4m<br\/>nginx 1\/1 Running 0 23m<br\/>[desk@cli]$ k get pod nginx -n prod -o yaml | grep -E &#8216;privileged|RootFileSystem&#8217;<br\/>{&#8220;apiVersion&#8221;:&#8221;v1&#8243;,&#8221;kind&#8221;:&#8221;Pod&#8221;,&#8221;metadata&#8221;:{&#8220;annotations&#8221;:{},&#8221;creationTimestamp&#8221;:null,&#8221;labels&#8221;:{&#8220;run&#8221;:&#8221;nginx&#8221;},&#8221;name&#8221;:&#8221;nginx&#8221;,&#8221;namespace&#8221;:&#8221;prod&#8221;},&#8221;spec&#8221;:{&#8220;containers&#8221;:[{&#8220;image&#8221;:&#8221;nginx&#8221;,&#8221;name&#8221;:&#8221;nginx&#8221;,&#8221;resources&#8221;:{},&#8221;securityContext&#8221;:{&#8220;privileged&#8221;:true}}],&#8221;dnsPolicy&#8221;:&#8221;ClusterFirst&#8221;,&#8221;restartPolicy&#8221;:&#8221;Always&#8221;},&#8221;status&#8221;:{}} f:privileged: {} privileged: true<br\/><img decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/uploads\/2022\/05\/CKS-94af084f0b643490417c49b75f2ca77d.jpg\"\/><br\/>[desk@cli]$ k delete pod nginx -n prod<br\/>[desk@cli]$ k get pod db -n prod -o yaml | grep -E &#8216;privileged|RootFilesystem&#8217;<br\/><img decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/uploads\/2022\/05\/CKS-85ed3611050d024ea170c522f24bde1c.jpg\"\/><br\/>[desk@cli]$ k delete pod cms -n prod  Reference: https:\/\/kubernetes.io\/docs\/concepts\/policy\/pod-security-policy\/ https:\/\/cloud.google.com\/architecture\/best-practices-for-operating-containers Reference:<br\/>[desk@cli]$ k delete pod cms -n prod  Reference: https:\/\/kubernetes.io\/docs\/concepts\/policy\/pod-security-policy\/ https:\/\/cloud.google.com\/architecture\/best-practices-for-operating-containers<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(3,this)' id='btn-3' value='See Answer'  \/><input type='hidden' id='questionType3' value='textarea' class=''><\/div><div class='watu-question' id='question-4'><div class='question-content'><p><strong>NO.13<\/strong> A container image scanner is set up on the cluster.<br \/>Given an incomplete configuration in the directory<br \/>\/etc\/kubernetes\/confcontrol and a functional container image scanner with HTTPS endpoint https:\/\/test-server.local.8081\/image_policy<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1479' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5760' \/><div class='watu-question-choice'><input type='radio' name='answer-1479[]' id='answer-id-5760' class='answer answer-4 php-answer-label answerof-1479' value='5760' \/>&nbsp;<label for='answer-id-5760' id='answer-label-5760' class='php-answer-label answer label-4'><span class='answer'>1. Enable the admission plugin.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'>2. Validate the control configuration and change it to implicit deny.<br\/>Finally, test the configuration by deploying the pod having the image tag as latest.<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(4,this)' id='btn-4' value='See Answer'  \/><input type='hidden' id='questionType4' value='radio' class=''><\/div><div class='watu-question' id='question-5'><div class='question-content'><p><strong>NO.14<\/strong> SIMULATION<br \/>Analyze and edit the given Dockerfile<br \/>FROM ubuntu:latest<br \/>RUN apt-get update -y<br \/>RUN apt-install nginx -y<br \/>COPY entrypoint.sh \/<br \/>ENTRYPOINT [&#8220;\/entrypoint.sh&#8221;]<br \/>USER ROOT<br \/>Fixing two instructions present in the file being prominent security best practice issues Analyze and edit the deployment manifest file apiVersion: v1 kind: Pod metadata:<br \/>name: security-context-demo-2<br \/>spec:<br \/>securityContext:<br \/>runAsUser: 1000<br \/>containers:<br \/>&#8211; name: sec-ctx-demo-2<br \/>image: gcr.io\/google-samples\/node-hello:1.0<br \/>securityContext:<br \/>runAsUser: 0<br \/>privileged: True<br \/>allowPrivilegeEscalation: false<br \/>Fixing two fields present in the file being prominent security best practice issues Don&#8217;t add or remove configuration settings; only modify the existing configuration settings Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 5487<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1480' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5761' \/><div class='watu-question-choice'><input type='radio' name='answer-1480[]' id='answer-id-5761' class='answer answer-5 php-answer-label answerof-1480' value='5761' \/>&nbsp;<label for='answer-id-5761' id='answer-label-5761' class='php-answer-label answer label-5'><span class='answer'>Send us the Feedback on it.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(5,this)' id='btn-5' value='See Answer'  \/><input type='hidden' id='questionType5' value='radio' class=''><\/div><div class='watu-question' id='question-6'><div class='question-content'><p><strong>NO.15<\/strong> SIMULATION<br \/>Given an existing Pod named nginx-pod running in the namespace test-system, fetch the service-account-name used and put the content in \/candidate\/KSC00124.txt Create a new Role named dev-test-role in the namespace test-system, which can perform update operations, on resources of type namespaces.<br \/>Create a new RoleBinding named dev-test-role-binding, which binds the newly created Role to the Pod&#8217;s ServiceAccount ( found in the Nginx pod running in namespace test-system).<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1481' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5762' \/><div class='watu-question-choice'><input type='radio' name='answer-1481[]' id='answer-id-5762' class='answer answer-6 php-answer-label answerof-1481' value='5762' \/>&nbsp;<label for='answer-id-5762' id='answer-label-5762' class='php-answer-label answer label-6'><span class='answer'>Sendusyourfeedbackonit<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(6,this)' id='btn-6' value='See Answer'  \/><input type='hidden' id='questionType6' value='radio' class=''><\/div><div class='watu-question' id='question-7'><div class='question-content'><p><strong>NO.16<\/strong> SIMULATION<br \/>Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that<br \/>1. logs are stored at \/var\/log\/kubernetes-logs.txt.<br \/>2. Log files are retained for 12 days.<br \/>3. at maximum, a number of 8 old audit logs files are retained.<br \/>4. set the maximum size before getting rotated to 200MB<br \/>Edit and extend the basic policy to log:<br \/>1. namespaces changes at RequestResponse<br \/>2. Log the request body of secrets changes in the namespace kube-system.<br \/>3. Log all other resources in core and extensions at the Request level.<br \/>4. Log &#8220;pods\/portforward&#8221;, &#8220;services\/proxy&#8221; at Metadata level.<br \/>5. Omit the Stage RequestReceived<br \/>All other requests at the Metadata level<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1482' \/><textarea name='answer-1482[]' rows='5' cols='40' id='textarea_q_1482' class='watu-textarea watu-textarea-7'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what&#8217;s recorded and the backends persist the records.<br\/>You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes Benchmark controls.<br\/>The audit log can be enabled by default using the following configuration in cluster.yml:<br\/>services:<br\/>kube-api:<br\/>audit_log:<br\/>enabled: true<br\/>When the audit log is enabled, you should be able to see the default values at \/etc\/kubernetes\/audit-policy.yaml The log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:<br\/>&#8211;audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. &#8211; means standard out<br\/>&#8211;audit-log-maxage defined the maximum number of days to retain old audit log files<br\/>&#8211;audit-log-maxbackup defines the maximum number of audit log files to retain<br\/>&#8211;audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated If your cluster&#8217;s control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted. For example:<br\/>&#8211;audit-policy-file=\/etc\/kubernetes\/audit-policy.yaml \\<br\/>&#8211;audit-log-path=\/var\/log\/audit.log<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(7,this)' id='btn-7' value='See Answer'  \/><input type='hidden' id='questionType7' value='textarea' class=''><\/div><div class='watu-question' id='question-8'><div class='question-content'><p><strong>NO.17<\/strong> You can switch the cluster\/configuration context using the following command:<br \/>[desk@cli] $ kubectl config use-context qa<br \/>Context:<br \/>A pod fails to run because of an incorrectly specified ServiceAccount<br \/>Task:<br \/>Create a new service account named backend-qa in an existing namespace qa, which must not have access to any secret.<br \/>Edit the frontend pod yaml to use backend-qa service account<br \/>Note: You can find the frontend pod yaml at \/home\/cert_masters\/frontend-pod.yaml<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1483' \/><textarea name='answer-1483[]' rows='5' cols='40' id='textarea_q_1483' class='watu-textarea watu-textarea-8'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>[desk@cli] $ k create sa backend-qa -n qa<br\/>sa\/backend-qa created<br\/>[desk@cli] $ k get role,rolebinding -n qa<br\/>No resources found in qa namespace.<br\/>[desk@cli] $ k create role backend -n qa &#8211;resource pods,namespaces,configmaps &#8211;verb list<br\/># No access to secret<br\/>[desk@cli] $ k create rolebinding backend -n qa &#8211;role backend &#8211;serviceaccount qa:backend-qa<br\/>[desk@cli] $ vim \/home\/cert_masters\/frontend-pod.yaml<br\/>apiVersion: v1<br\/>kind: Pod<br\/>metadata:<br\/>name: frontend<br\/>spec:<br\/>serviceAccountName: backend-qa # Add this<br\/>image: nginx<br\/>name: frontend<br\/>[desk@cli] $ k apply -f \/home\/cert_masters\/frontend-pod.yaml<br\/>pod created<br\/>[desk@cli] $ k create sa backend-qa -n qa<br\/>serviceaccount\/backend-qa created<br\/>[desk@cli] $ k get role,rolebinding -n qa<br\/>No resources found in qa namespace.<br\/>[desk@cli] $ k create role backend -n qa &#8211;resource pods,namespaces,configmaps &#8211;verb list role.rbac.authorization.k8s.io\/backend created<br\/>[desk@cli] $ k create rolebinding backend -n qa &#8211;role backend &#8211;serviceaccount qa:backend-qa rolebinding.rbac.authorization.k8s.io\/backend created<br\/>[desk@cli] $ vim \/home\/cert_masters\/frontend-pod.yaml<br\/>apiVersion: v1<br\/>kind: Pod<br\/>metadata:<br\/>name: frontend<br\/>spec:<br\/>serviceAccountName: backend-qa # Add this<br\/>image: nginx<br\/>name: frontend<br\/>[desk@cli] $ k apply -f \/home\/cert_masters\/frontend-pod.yaml pod\/frontend created  https:\/\/kubernetes.io\/docs\/tasks\/configure-pod-container\/configure-service-account\/ pod\/frontend created<br\/>[desk@cli] $ k apply -f \/home\/cert_masters\/frontend-pod.yaml pod\/frontend created  https:\/\/kubernetes.io\/docs\/tasks\/configure-pod-container\/configure-service-account\/<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(8,this)' id='btn-8' value='See Answer'  \/><input type='hidden' id='questionType8' value='textarea' class=''><\/div><div class='watu-question' id='question-9'><div class='question-content'><p><strong>NO.18<\/strong> Context:<br \/>Cluster: gvisor<br \/>Master node: master1<br \/>Worker node: worker1<br \/>You can switch the cluster\/configuration context using the following command:<br \/>[desk@cli] $ kubectl config use-context gvisor<br \/>Context: This cluster has been prepared to support runtime handler, runsc as well as traditional one.<br \/>Task:<br \/>Create a RuntimeClass named not-trusted using the prepared runtime handler names runsc.<br \/>Update all Pods in the namespace server to run on newruntime.<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1484' \/><textarea name='answer-1484[]' rows='5' cols='40' id='textarea_q_1484' class='watu-textarea watu-textarea-9'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>Find all the pods\/deployment and edit runtimeClassName parameter to not-trusted under spec<br\/>[desk@cli] $ k edit deploy nginx<br\/>spec:<br\/>runtimeClassName: not-trusted. # Add this<br\/>Explanation<br\/>[desk@cli] $vim runtime.yaml<br\/>apiVersion: node.k8s.io\/v1<br\/>kind: RuntimeClass<br\/>metadata:<br\/>name: not-trusted<br\/>handler: runsc<br\/>[desk@cli] $ k apply -f runtime.yaml<br\/>[desk@cli] $ k get pods<br\/>NAME READY STATUS RESTARTS AGE<br\/>nginx-6798fc88e8-chp6r 1\/1 Running 0 11m<br\/>nginx-6798fc88e8-fs53n 1\/1 Running 0 11m<br\/>nginx-6798fc88e8-ndved 1\/1 Running 0 11m<br\/>[desk@cli] $ k get deploy<br\/>NAME READY UP-TO-DATE AVAILABLE AGE<br\/>nginx 3\/3 11 3 5m<br\/>[desk@cli] $ k edit deploy nginx<br\/><img decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/uploads\/2022\/05\/CKS-aaac8ee85832ddbaea132ed109f6dbd8.jpg\"\/><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(9,this)' id='btn-9' value='See Answer'  \/><input type='hidden' id='questionType9' value='textarea' class=''><\/div><div class='watu-question' id='question-10'><div class='question-content'><p><strong>NO.19<\/strong> SIMULATION<br \/>Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.<br \/>Fix all of the following violations that were found against the API server:- a. Ensure the &#8211;authorization-mode argument includes RBAC b. Ensure the &#8211;authorization-mode argument includes Node c. Ensure that the &#8211;profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the &#8211;anonymous-auth argument is set to false.<br \/>b. Ensure that the &#8211;authorization-mode argument is set to Webhook.<br \/>Fix all of the following violations that were found against the ETCD:-<br \/>a. Ensure that the &#8211;auto-tls argument is not set to true<br \/>Hint: Take the use of Tool Kube-Bench<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1485' \/><textarea name='answer-1485[]' rows='5' cols='40' id='textarea_q_1485' class='watu-textarea watu-textarea-10'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>API server:<br\/>Ensure the &#8211;authorization-mode argument includes RBAC<br\/>Turn on Role Based Access Control. Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.<br\/>Fix &#8211; Buildtime<br\/>Kubernetes<br\/>apiVersion: v1<br\/>kind: Pod<br\/>metadata:<br\/>creationTimestamp: null<br\/>labels:<br\/>component: kube-apiserver<br\/>tier: control-plane<br\/>name: kube-apiserver<br\/>namespace: kube-system<br\/>spec:<br\/>containers:<br\/>&#8211; command:<br\/>+ &#8211; kube-apiserver<br\/>+ &#8211; &#8211;authorization-mode=RBAC,Node<br\/>image: gcr.io\/google_containers\/kube-apiserver-amd64:v1.6.0<br\/>livenessProbe:<br\/>failureThreshold: 8<br\/>httpGet:<br\/>host: 127.0.0.1<br\/>path: \/healthz<br\/>port: 6443<br\/>scheme: HTTPS<br\/>initialDelaySeconds: 15<br\/>timeoutSeconds: 15<br\/>name: kube-apiserver-should-pass<br\/>resources:<br\/>requests:<br\/>cpu: 250m<br\/>volumeMounts:<br\/>&#8211; mountPath: \/etc\/kubernetes\/<br\/>name: k8s<br\/>readOnly: true<br\/>&#8211; mountPath: \/etc\/ssl\/certs<br\/>name: certs<br\/>&#8211; mountPath: \/etc\/pki<br\/>name: pki<br\/>hostNetwork: true<br\/>volumes:<br\/>&#8211; hostPath:<br\/>path: \/etc\/kubernetes<br\/>name: k8s<br\/>&#8211; hostPath:<br\/>path: \/etc\/ssl\/certs<br\/>name: certs<br\/>&#8211; hostPath:<br\/>path: \/etc\/pki<br\/>name: pki<br\/>Ensure the &#8211;authorization-mode argument includes Node<br\/>Remediation: Edit the API server pod specification file \/etc\/kubernetes\/manifests\/kube-apiserver.yaml on the master node and set the &#8211;authorization-mode parameter to a value that includes Node.<br\/>&#8211;authorization-mode=Node,RBAC<br\/>Audit:<br\/>\/bin\/ps -ef | grep kube-apiserver | grep -v grep<br\/>Expected result:<br\/>&#8216;Node,RBAC&#8217; has &#8216;Node&#8217;<br\/>Ensure that the &#8211;profiling argument is set to false<br\/>Remediation: Edit the API server pod specification file \/etc\/kubernetes\/manifests\/kube-apiserver.yaml on the master node and set the below parameter.<br\/>&#8211;profiling=false<br\/>Audit:<br\/>\/bin\/ps -ef | grep kube-apiserver | grep -v grep<br\/>Expected result:<br\/>&#8216;false&#8217; is equal to &#8216;false&#8217;<br\/>Fix all of the following violations that were found against the Kubelet:- Ensure the &#8211;anonymous-auth argument is set to false.<br\/>Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file \/etc\/systemd\/system\/kubelet.service.d\/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.<br\/>&#8211;anonymous-auth=false<br\/>Based on your system, restart the kubelet service. For example:<br\/>systemctl daemon-reload<br\/>systemctl restart kubelet.service<br\/>Audit:<br\/>\/bin\/ps -fC kubelet<br\/>Audit Config:<br\/>\/bin\/cat \/var\/lib\/kubelet\/config.yaml<br\/>Expected result:<br\/>&#8216;false&#8217; is equal to &#8216;false&#8217;<br\/>2) Ensure that the &#8211;authorization-mode argument is set to Webhook.<br\/>Audit<br\/>docker inspect kubelet | jq -e &#8216;.[0].Args[] | match(&#8220;&#8211;authorization-mode=Webhook&#8221;).string&#8217; Returned Value: &#8211;authorization-mode=Webhook Fix all of the following violations that were found against the ETCD:- a. Ensure that the &#8211;auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.<br\/>Fix &#8211; Buildtime<br\/>Kubernetes<br\/>apiVersion: v1<br\/>kind: Pod<br\/>metadata:<br\/>annotations:<br\/>scheduler.alpha.kubernetes.io\/critical-pod: &#8220;&#8221;<br\/>creationTimestamp: null<br\/>labels:<br\/>component: etcd<br\/>tier: control-plane<br\/>name: etcd<br\/>namespace: kube-system<br\/>spec:<br\/>containers:<br\/>&#8211; command:<br\/>+ &#8211; etcd<br\/>+ &#8211; &#8211;auto-tls=true<br\/>image: k8s.gcr.io\/etcd-amd64:3.2.18<br\/>imagePullPolicy: IfNotPresent<br\/>livenessProbe:<br\/>exec:<br\/>command:<br\/>&#8211; \/bin\/sh<br\/>&#8211; -ec<br\/>&#8211; ETCDCTL_API=3 etcdctl &#8211;endpoints=https:\/\/[192.168.22.9]:2379 &#8211;cacert=\/etc\/kubernetes\/pki\/etcd\/ca.crt<br\/>&#8211;cert=\/etc\/kubernetes\/pki\/etcd\/healthcheck-client.crt &#8211;key=\/etc\/kubernetes\/pki\/etcd\/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts:<br\/>&#8211; mountPath: \/var\/lib\/etcd<br\/>name: etcd-data<br\/>&#8211; mountPath: \/etc\/kubernetes\/pki\/etcd<br\/>name: etcd-certs<br\/>hostNetwork: true<br\/>priorityClassName: system-cluster-critical<br\/>volumes:<br\/>&#8211; hostPath:<br\/>path: \/var\/lib\/etcd<br\/>type: DirectoryOrCreate<br\/>name: etcd-data<br\/>&#8211; hostPath:<br\/>path: \/etc\/kubernetes\/pki\/etcd<br\/>type: DirectoryOrCreate<br\/>name: etcd-certs<br\/>status: {}<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(10,this)' id='btn-10' value='See Answer'  \/><input type='hidden' id='questionType10' value='textarea' class=''><\/div><div class='watu-question' id='question-11'><div class='question-content'><p><strong>NO.20<\/strong> You can switch the cluster\/configuration context using the following command:<br \/>[desk@cli] $ kubectl config use-context dev<br \/>A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn&#8217;t have any other NetworkPolicy defined.<br \/>Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.<br \/>Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.<br \/>You can find a skeleton manifests file at \/home\/cert_masters\/network-policy.yaml<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1486' \/><textarea name='answer-1486[]' rows='5' cols='40' id='textarea_q_1486' class='watu-textarea watu-textarea-11'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>master1 $ k get pods -n test &#8211;show-labels<br\/>NAME READY STATUS RESTARTS AGE LABELS<br\/>test-pod 1\/1 Running 0 34s role=test,run=test-pod<br\/>testing 1\/1 Running 0 17d run=testing<br\/>$ vim netpol.yaml<br\/>apiVersion: networking.k8s.io\/v1<br\/>kind: NetworkPolicy<br\/>metadata:<br\/>name: deny-network<br\/>namespace: test<br\/>spec:<br\/>podSelector: {}<br\/>policyTypes:<br\/>&#8211; Ingress<br\/>&#8211; Egress<br\/>master1 $ k apply -f netpol.yaml<br\/>Explanation<br\/>controlplane $ k get pods -n test &#8211;show-labels<br\/>NAME READY STATUS RESTARTS AGE LABELS<br\/>test-pod 1\/1 Running 0 34s role=test,run=test-pod<br\/>testing 1\/1 Running 0 17d run=testing<br\/>master1 $ vim netpol1.yaml<br\/>apiVersion: networking.k8s.io\/v1<br\/>kind: NetworkPolicy<br\/>metadata:<br\/>name: deny-network<br\/>namespace: test<br\/>spec:<br\/>podSelector: {}<br\/>policyTypes:<br\/>&#8211; Ingress<br\/>&#8211; Egress<br\/>master1 $ k apply -f netpol1.yaml  Reference: https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/ Reference:<br\/>master1 $ k apply -f netpol1.yaml  Reference: https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/ Explanation controlplane $ k get pods -n test &#8211;show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1\/1 Running 0 34s role=test,run=test-pod testing 1\/1 Running 0 17d run=testing master1 $ vim netpol1.yaml apiVersion: networking.k8s.io\/v1 kind: NetworkPolicy metadata:<br\/>name: deny-network<br\/>namespace: test<br\/>spec:<br\/>podSelector: {}<br\/>policyTypes:<br\/>&#8211; Ingress<br\/>&#8211; Egress<br\/>master1 $ k apply -f netpol1.yaml  Reference: https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/ master1 $ k apply -f netpol1.yaml  Reference: https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(11,this)' id='btn-11' value='See Answer'  \/><input type='hidden' id='questionType11' value='textarea' class=''><\/div><div class='watu-question' id='question-12'><div class='question-content'><p><strong>NO.21<\/strong> Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.<br \/>Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.<br \/>b. Ensure that the admission control plugin PodSecurityPolicy is set.<br \/>c. Ensure that the &#8211;kubelet-certificate-authority argument is set as appropriate.<br \/>Fix all of the following violations that were found against the Kubelet:- a. Ensure the &#8211;anonymous-auth argument is set to false.<br \/>b. Ensure that the &#8211;authorization-mode argument is set to Webhook.<br \/>Fix all of the following violations that were found against the ETCD:-<br \/>a. Ensure that the &#8211;auto-tls argument is not set to true<br \/>b. Ensure that the &#8211;peer-auto-tls argument is not set to true<br \/>Hint: Take the use of Tool Kube-Bench<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1487' \/><textarea name='answer-1487[]' rows='5' cols='40' id='textarea_q_1487' class='watu-textarea watu-textarea-12'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.<br\/>apiVersion: v1<br\/>kind: Pod<br\/>metadata:<br\/>creationTimestamp: null<br\/>labels:<br\/>component: kubelet<br\/>tier: control-plane<br\/>name: kubelet<br\/>namespace: kube-system<br\/>spec:<br\/>containers:<br\/>&#8211; command:<br\/>&#8211; kube-controller-manager<br\/>+ &#8211; &#8211;feature-gates=RotateKubeletServerCertificate=true<br\/>image: gcr.io\/google_containers\/kubelet-amd64:v1.6.0<br\/>livenessProbe:<br\/>failureThreshold: 8<br\/>httpGet:<br\/>host: 127.0.0.1<br\/>path: \/healthz<br\/>port: 6443<br\/>scheme: HTTPS<br\/>initialDelaySeconds: 15<br\/>timeoutSeconds: 15<br\/>name: kubelet<br\/>resources:<br\/>requests:<br\/>cpu: 250m<br\/>volumeMounts:<br\/>&#8211; mountPath: \/etc\/kubernetes\/<br\/>name: k8s<br\/>readOnly: true<br\/>&#8211; mountPath: \/etc\/ssl\/certs<br\/>name: certs<br\/>&#8211; mountPath: \/etc\/pki<br\/>name: pki<br\/>hostNetwork: true<br\/>volumes:<br\/>&#8211; hostPath:<br\/>path: \/etc\/kubernetes<br\/>name: k8s<br\/>&#8211; hostPath:<br\/>path: \/etc\/ssl\/certs<br\/>name: certs<br\/>&#8211; hostPath:<br\/>path: \/etc\/pki<br\/>name: pki<br\/>b. Ensure that the admission control plugin PodSecurityPolicy is set.<br\/>audit: &#8220;\/bin\/ps -ef | grep $apiserverbin | grep -v grep&#8221;<br\/>tests:<br\/>test_items:<br\/>&#8211; flag: &#8220;&#8211;enable-admission-plugins&#8221;<br\/>compare:<br\/>op: has<br\/>value: &#8220;PodSecurityPolicy&#8221;<br\/>set: true<br\/>remediation: |<br\/>Follow the documentation and create Pod Security Policy objects as per your environment.<br\/>Then, edit the API server pod specification file $apiserverconf<br\/>on the master node and set the &#8211;enable-admission-plugins parameter to a value that includes PodSecurityPolicy :<br\/>&#8211;enable-admission-plugins=&#8230;,PodSecurityPolicy,&#8230;<br\/>Then restart the API Server.<br\/>scored: true<br\/>c. Ensure that the &#8211;kubelet-certificate-authority argument is set as appropriate.<br\/>audit: &#8220;\/bin\/ps -ef | grep $apiserverbin | grep -v grep&#8221;<br\/>tests:<br\/>test_items:<br\/>&#8211; flag: &#8220;&#8211;kubelet-certificate-authority&#8221;<br\/>set: true<br\/>remediation: |<br\/>Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file<br\/>$apiserverconf on the master node and set the &#8211;kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.<br\/>&#8211;kubelet-certificate-authority=&lt;ca-string&gt;<br\/>scored: true<br\/>Fix all of the following violations that were found against the ETCD:-<br\/>a. Ensure that the &#8211;auto-tls argument is not set to true<br\/>Edit the etcd pod specification file $etcdconf on the master<br\/>node and either remove the &#8211;auto-tls parameter or set it to false.<br\/>&#8211;auto-tls=false<br\/>b. Ensure that the &#8211;peer-auto-tls argument is not set to true<br\/>Edit the etcd pod specification file $etcdconf on the master<br\/>node and either remove the &#8211;peer-auto-tls parameter or set it to false.<br\/>&#8211;peer-auto-tls=false<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(12,this)' id='btn-12' value='See Answer'  \/><input type='hidden' id='questionType12' value='textarea' class=''><\/div><div class='watu-question' id='question-13'><div class='question-content'><p><strong>NO.22<\/strong> SIMULATION<br \/>Create a RuntimeClass named untrusted using the prepared runtime handler named runsc.<br \/>Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.<br \/>Verify: Exec the pods and run the dmesg, you will see output like this:-<br \/><img decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/uploads\/2022\/05\/CKS-f29ad36ed0e80eb2167e836116493cf4.jpg\"\/><\/p>\n<\/div><input type='hidden' name='question_id[]' value='1488' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5763' \/><div class='watu-question-choice'><input type='radio' name='answer-1488[]' id='answer-id-5763' class='answer answer-13 php-answer-label answerof-1488' value='5763' \/>&nbsp;<label for='answer-id-5763' id='answer-label-5763' class='php-answer-label answer label-13'><span class='answer'>Send us your feedback on it.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(13,this)' id='btn-13' value='See Answer'  \/><input type='hidden' id='questionType13' value='radio' class=''><\/div><div class='watu-question' id='question-14'><div class='question-content'><p><strong>NO.23<\/strong> SIMULATION<br \/>Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g:- ETCDCTL_API=3 etcdctl get \/registry\/secrets\/default\/cks-secret &#8211;cacert=&#8221;ca.crt&#8221; &#8211;cert=&#8221;server.crt&#8221; &#8211;key=&#8221;server.key&#8221; Output<br \/><img decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/uploads\/2022\/05\/CKS-08153583cb360d64ff361b8a5168038c.jpg\"\/><br \/>Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1489' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5764' \/><div class='watu-question-choice'><input type='radio' name='answer-1489[]' id='answer-id-5764' class='answer answer-14 php-answer-label answerof-1489' value='5764' \/>&nbsp;<label for='answer-id-5764' id='answer-label-5764' class='php-answer-label answer label-14'><span class='answer'>Send us the Feedback on it.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'><\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(14,this)' id='btn-14' value='See Answer'  \/><input type='hidden' id='questionType14' value='radio' class=''><\/div><div class='watu-question' id='question-15'><div class='question-content'><p><strong>NO.24<\/strong> SIMULATION<br \/>Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.<br \/>Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1490' \/><textarea name='answer-1490[]' rows='5' cols='40' id='textarea_q_1490' class='watu-textarea watu-textarea-15'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>Install the Runtime Class for gVisor<br\/>{ # Step 1: Install a RuntimeClass<br\/>cat &lt;&lt;EOF | kubectl apply -f &#8211;<br\/>apiVersion: node.k8s.io\/v1beta1<br\/>kind: RuntimeClass<br\/>metadata:<br\/>name: gvisor<br\/>handler: runsc<br\/>EOF<br\/>}<br\/>Create a Pod with the gVisor Runtime Class<br\/>{ # Step 2: Create a pod<br\/>cat &lt;&lt;EOF | kubectl apply -f &#8211;<br\/>apiVersion: v1<br\/>kind: Pod<br\/>metadata:<br\/>name: nginx-gvisor<br\/>spec:<br\/>runtimeClassName: gvisor<br\/>containers:<br\/>&#8211; name: nginx<br\/>image: nginx<br\/>EOF<br\/>}<br\/>Verify that the Pod is running<br\/>{ # Step 3: Get the pod<br\/>kubectl get pod nginx-gvisor -o wide<br\/>}<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(15,this)' id='btn-15' value='See Answer'  \/><input type='hidden' id='questionType15' value='textarea' class=''><\/div><div class='watu-question' id='question-16'><div class='question-content'><p><strong>NO.25<\/strong> A container image scanner is set up on the cluster.<br \/>Given an incomplete configuration in the directory<br \/>\/etc\/Kubernetes\/confcontrol and a functional container image scanner with HTTPS endpoint https:\/\/acme.local.8081\/image_policy<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1491' \/><div class='watu-questions-wrap '><input type='hidden' name='answer_ids[]' class='watu-answer-ids' value='5765' \/><div class='watu-question-choice'><input type='radio' name='answer-1491[]' id='answer-id-5765' class='answer answer-16 php-answer-label answerof-1491' value='5765' \/>&nbsp;<label for='answer-id-5765' id='answer-label-5765' class='php-answer-label answer label-16'><span class='answer'>1. Enable the admission plugin.<\/span><\/label><\/div>\n<\/div><div class='show-question-feedback' style='display:none;'>2. Validate the control configuration and change it to implicit deny.<br\/>Finally, test the configuration by deploying the pod having the image tag as the latest.<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(16,this)' id='btn-16' value='See Answer'  \/><input type='hidden' id='questionType16' value='radio' class=''><\/div><div class='watu-question' id='question-17'><div class='question-content'><p><strong>NO.26<\/strong> a. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace.<br \/>Store the value of the token in the token.txt<br \/>b. Create a new secret named test-db-secret in the DB namespace with the following content:<br \/>username: mysql<br \/>password: password@123<br \/>Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path \/etc\/mysql-credentials<\/p>\n<\/div><input type='hidden' name='question_id[]' value='1492' \/><textarea name='answer-1492[]' rows='5' cols='40' id='textarea_q_1492' class='watu-textarea watu-textarea-17'><\/textarea><div class='watu-questions-wrap '><\/div><div class='show-question-feedback' style='display:none;'>To add a Kubernetes cluster to your project, group, or instance:<br\/>Navigate to your:<br\/>Project&#8217;s Operations &gt; Kubernetes page, for a project-level cluster.<br\/>Group&#8217;s Kubernetes page, for a group-level cluster.<br\/>Admin Area &gt; Kubernetes page, for an instance-level cluster.<br\/>Click Add Kubernetes cluster.<br\/>Click the Add existing cluster tab and fill in the details:<br\/>Kubernetes cluster name (required) &#8211; The name you wish to give the cluster.<br\/>Environment scope (required) &#8211; The associated environment to this cluster.<br\/>API URL (required) &#8211; It&#8217;s the URL that GitLab uses to access the Kubernetes API. Kubernetes exposes several APIs, we want the &#8220;base&#8221; URL that is common to all of them. For example, https:\/\/kubernetes.example.com rather than https:\/\/kubernetes.example.com\/api\/v1.<br\/>Get the API URL by running this command:<br\/>kubectl cluster-info | grep -E &#8216;Kubernetes master|Kubernetes control plane&#8217; | awk &#8216;\/http\/ {print $NF}&#8217; CA certificate (required) &#8211; A valid Kubernetes certificate is needed to authenticate to the cluster. We use the certificate created by default.<br\/>List the secrets with kubectl get secrets, and one should be named similar to default-token-xxxxx. Copy that token name for use below.<br\/>Get the certificate by running this command:<br\/>kubectl get secret &lt;secret name&gt; -o jsonpath=&#8221;{[&#8216;data&#8217;][&#8216;ca\\.crt&#8217;]}&#8221;<\/div><input type='button' class='showchecked' style='margin: 10px 0;' onclick='showanswer1(17,this)' id='btn-17' value='See Answer'  \/><input type='hidden' id='questionType17' value='textarea' class=''><\/div><div style='display:none' id='question-18'><br \/><div class='question-content'><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/plugins\/watu\/loading.gif\" width=\"16\" height=\"16\" alt=\"Loading ...\" title=\"Loading ...\" \/>&nbsp;Loading &#8230;<\/div><\/div><br \/>\n<input type=\"button\" name=\"action\" onclick=\"Watu.submitResult()\" id=\"action-button\" style=\"margin:0 auto 20px auto;\" value=\"View Results\"  class=\"watu-submit-button\" \/>\n<input type=\"hidden\" name=\"no_ajax\" value=\"0\"><input type=\"hidden\" name=\"quiz_id\" value=\"76\" \/>\n<input type=\"hidden\" id=\"watuStartTime\" name=\"start_time\" value=\"2026-09-22 14:35:15\" \/>\n<\/form>\n<\/div>\n<div id=\"watu-loading-result\" style=\"display:none;\">\n\t<p align=\"center\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.topexamcollection.com\/wp-content\/plugins\/watu\/loading.gif\" width=\"16\" height=\"16\" alt=\"Loading\" title=\"Loading\" \/><\/p>\n<\/div>\t\n<script type=\"text\/javascript\">\nvar exam_id=0;\nvar question_ids='';\nvar watuURL='';\njQuery(function($){\nquestion_ids = \"1476,1477,1478,1479,1480,1481,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,1492\";\nexam_id = 76;\nWatu.exam_id = exam_id;\nWatu.qArr = question_ids.split(',');\nWatu.post_id = 154;\nWatu.singlePage = '1';\nWatu.hAppID = \"0.62011700 1790087715\";\nwatuURL = \"https:\/\/blog.topexamcollection.com\/wp-admin\/admin-ajax.php\";\nWatu.noAlertUnanswered = 0;\n});\n\nfunction showanswer1(e,q) {\n\tvar check = new Array();\n\tjQuery('.answer-' + e).each(function (i) {\n\t\tcheck.push(this.checked)\n\t})\n\tlet textval = jQuery('.watu-textarea-' + e).val()\n\tif (jQuery.inArray(true, check) >= 0 || textval !== '' && textval !== undefined) {\n\t\tjQuery(q).stop().fadeOut(300)\n\t\tjQuery('.php-answer-label.label-' + e).addClass(\n\t\t\t'correct-answer'\n\t\t)\n\t\tjQuery('.answer-' + e).each(function (i) {\n\t\t\tif (this.checked && this.className.match(\/js\\-answer\/)) {\n\t\t\t\tvar number = this.id.toString().replace(\/\\D\/g, '')\n\t\t\t\tif (number) {\n\t\t\t\t\tjQuery('#answer-label-' + number).addClass('user-answer')\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\t\tjQuery(q).siblings('.show-question-feedback').stop().fadeIn(300)\n\t\ttextval = ''\n\t} else if (textval == '' || textval == undefined){\n\t\t\/\/jQuery(\".hint\").stop().fadeIn(300)\n\t\talert('Please first answer the question');\n\t}\n}\nvar btnisshow = jQuery(\".php-answer-label\").length\nif (btnisshow > 0) {\n\tjQuery('.showchecked').show()\n} else {\n\tjQuery('.showchecked').hide()\n}\n<\/script>\n\n<p><strong>Online Exam Practice Tests with detailed explanations!: <a href=\"https:\/\/www.topexamcollection.com\/CKS-vce-collection.html\" target=\"_blank\" rel=\"noopener\">https:\/\/www.topexamcollection.com\/CKS-vce-collection.html<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[May-2022] Pass Linux Foundation CKS Tests Engine pdf &#8211; All Free Dumps Certified Kubernetes Security Specialist (CKS) Practice Tests 2022 | Pass CKS with confidence! Online Exam Practice Tests with detailed explanations!: https:\/\/www.topexamcollection.com\/CKS-vce-collection.html<\/p>\n","protected":false},"author":1,"featured_media":155,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[547,548],"tags":[542,544,541,540,546,543,539,545],"class_list":["post-154","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cks","category-linux-foundation","tag-cks-exam-bootcamp","tag-cks-exam-quiz","tag-cks-free-download-pdf","tag-cks-practice-questions","tag-cks-real-question-on-the-exam","tag-cks-reliable-free-study-questions","tag-cks-reliable-test-guide","tag-cks-valid-exam-prep"],"_links":{"self":[{"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/posts\/154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/comments?post=154"}],"version-history":[{"count":0,"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/posts\/154\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/media\/155"}],"wp:attachment":[{"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/media?parent=154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/categories?post=154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.topexamcollection.com\/de\/wp-json\/wp\/v2\/tags?post=154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}