Added

1. Kubelet Security 2. Correct links after restructuring the individual topics into a separate folder
jayendrapatil · Dec 17, 2021 · 21cf0e6 · 21cf0e6
1 parent 29b343f
commit 21cf0e6
Show file tree

Hide file tree

Showing 12 changed files with 83 additions and 21 deletions.
diff --git a/cka/1.cluster_architecture_installation_configuration.md b/cka/1.cluster_architecture_installation_configuration.md
@@ -6,7 +6,7 @@
 
 <br />
 
-Refer [RBAC](../rbac.md)
+Refer [RBAC](../topics/rbac.md)
 
 <br />
 
@@ -30,6 +30,10 @@ Refer [Creating HA Kubernete cluster](https://kubernetes.io/docs/setup/productio
 
 <br />
 
+TBD
+
+<br />
+
 ## Perform a version upgrade on a Kubernetes cluster using Kubeadm
 
 <br />

diff --git a/cka/2.workloads_scheduling.md b/cka/2.workloads_scheduling.md
@@ -6,24 +6,24 @@
 
 <br />
 
-Refer [Deployment Rollouts](../deployments.md#deployment-rollout)
+Refer [Deployment Rollouts](../topics/deployments.md#deployment-rollout)
 
 <br />
 
 ## Use ConfigMaps and Secrets to configure applications
 
 <br />
 
-Refer [ConfigMaps](../configmaps.md)  
-Refer [Secrets](../secrets.md)  
+Refer [ConfigMaps](../topics/configmaps.md)  
+Refer [Secrets](../topics/secrets.md)  
 
 <br />
 
 ## Know how to scale applications
 
 <br />
 
-Refer [Deployment Rollouts](../deployments.md#deployment-scaling)
+Refer [Deployment Rollouts](../topics/deployments.md#deployment-scaling)
 
 <br />
 
@@ -39,7 +39,7 @@ TBD
 
 <br />
 
-Refer [Resources - Requests & Limits](../topics/pods/md#resources)
+Refer [Resources - Requests & Limits](../topics/pods.md#resources)
 
 <br />
 

diff --git a/cka/3.services_networking.md b/cka/3.services_networking.md
@@ -20,11 +20,11 @@ TBD
 
 ## Understand ClusterIP, NodePort, LoadBalancer service types and endpoints
 
-Refer [Services](../services.md)
+Refer [Services](../topics/services.md)
 
 ## Know how to use Ingress controllers and Ingress resources
 
-Refer [Ingress](../ingress.md)
+Refer [Ingress](../topics/ingress.md)
 
 ## Know how to configure and use CoreDNS
 

diff --git a/cka/4.storage.md b/cka/4.storage.md
@@ -30,6 +30,6 @@ TBD
 
 <br />
 
-Refer [Volumes](../topics/volumes.md
+Refer [Volumes](../topics/volumes.md)
 
 <br />
diff --git a/ckad/1.application_design_build.md b/ckad/1.application_design_build.md
@@ -14,22 +14,22 @@ TBD - Create docker images
 
 <br />
 
-Refer [Jobs & Cron Jobs](../jobs.md)
+Refer [Jobs & Cron Jobs](../topics/jobs.md)
 
 <br />
 
 ## Understand multi-container Pod design patterns (e.g. sidecar, init and others)
 
 <br />
 
-Refer [Multi-Container Pods](../pods#multi-container-pods)
+Refer [Multi-Container Pods](../topics/pods.md#multi-container-pods)
 
 <br />
 
 ## Utilize persistent and ephemeral volumes
 
 <br />
 
-Refer [Volumes](../volumes.md)
+Refer [Volumes](../topics/volumes.md)
 
 <br />
diff --git a/ckad/2.application_deployment.md b/ckad/2.application_deployment.md
@@ -12,7 +12,7 @@ TBD
 
 ## Understand Deployments and how to perform rolling updates
 
-Refer [Deployment Rollouts](../deployments.md#deployment-rollout)
+Refer [Deployment Rollouts](../topics/deployments.md#deployment-rollout)
 
 ## Use the Helm package manager to deploy existing packages
 

diff --git a/ckad/3.application_observability_maintenance.md b/ckad/3.application_observability_maintenance.md
@@ -12,15 +12,15 @@ TBD
 
 ## Implement probes and health checks
 
-Refer [Readiness & Liveness probes](../probes.md)
+Refer [Readiness & Liveness probes](../topics/probes.md)
 
 ## Use provided tools to monitor Kubernetes applications
 
-Refer [Monioring](../monitoring.md)
+Refer [Monioring](../topics/monitoring.md)
 
 ## Utilize container logs
 
-Refer [Logging](../logging.md)
+Refer [Logging](../topics/logging.md)
 
 ## Debugging in Kubernetes
 

diff --git a/ckad/4.application_environment_configuration_security.md b/ckad/4.application_environment_configuration_security.md
@@ -20,7 +20,7 @@ Refer [Admission Controllers](../topics/admission_controllers.md)
 
 <br />
 
-Refer [Resources - Requests & Limits](../topics/pods/md#resources)
+Refer [Resources - Requests & Limits](../topics/pods.md#resources)
 
 <br />
 

diff --git a/cks/1.cluster_setup.md b/cks/1.cluster_setup.md
@@ -30,7 +30,7 @@ Refer [Ingress with tls cert](../topics/ingress.md#ingress-security)
 
 <br />
 
-TBD
+Refer [Kubelet Security](../topics/kubelet_security.md)
 
 <br />
 

diff --git a/cks/4.minimize_microservice_vulnerabilities.md b/cks/4.minimize_microservice_vulnerabilities.md
@@ -16,7 +16,7 @@ Refer [Open Policy Agent](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-p
 
 <br />
 
-Refer [Secrets](../topicssecrets)
+Refer [Secrets](../topics/secrets.md)
 
 <br />
 

diff --git a/topics/README.md b/topics/README.md
@@ -13,8 +13,9 @@ Topics cover test exercises for each topics
  - [Falco](./falco.md)
  - [Ingress](./ingress.md)  
  - [Jobs](./jobs.md)  
- - [kube-bench](../kube-bench.md)
- - [Kubeconfig](./kubeconfig.md)  
+ - [kube-bench](./kube-bench.md)
+ - [Kubeconfig](./kubeconfig.md) .
+ - [Kubelet Security](./kubelet_security.md)
  - [Kubesec](./kubesec.md)
  - [Logging](./logging.md)  
  - [Monitoring](./monitoring.md)  

diff --git a/topics/kubelet_security.md b/topics/kubelet_security.md
@@ -0,0 +1,57 @@
+# [Kubelet Security](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/)
+
+<br />
+
+### Check the Kubelet Security
+
+<br />
+
+#### Check Kubelet configuration
+
+```bash
+ps -ef | grep kubelet # check the --config parameter
+# root      2600     1  3 05:21 ?        00:00:02 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --cgroup-driver=systemd --network-plugin=cni --pod-infra-container-image=k8s.gcr.io/pause:3.2 --resolv-conf=/run/systemd/resolve/resolv.conf
+```
+
+#### Viewing the kubelet configuration file `/var/lib/kubelet/config.yaml` 
+
+```yaml
+apiVersion: kubelet.config.k8s.io/v1beta1
+authentication:
+  anonymous:
+    enabled: false # anonymous auth should be disabled - It should not be true
+  webhook: # Authn mechanism set to webhook as certificate based auth instead of AlwaysAllow
+    cacheTTL: 0s
+    enabled: true
+  x509:
+    clientCAFile: /etc/kubernetes/pki/ca.crt
+authorization:
+  mode: Webhook # Authz mechanism set to webhook, instead of AlwaysAllow
+  webhook:
+    cacheAuthorizedTTL: 0s
+    cacheUnauthorizedTTL: 0s
+clusterDNS:
+- 10.96.0.10
+clusterDomain: cluster.local
+cpuManagerReconcilePeriod: 0s
+evictionPressureTransitionPeriod: 0s
+# additional lines omitted for brevity
+```
+
+#### Check the key and certificate in the `kube-apiserver.yaml` file
+
+```bash
+cat kube-apiserver.yaml | grep kubelet-client    
+# - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
+# - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
+```    
+
+#### Verify the authentication using the above cert and key
+
+```bash
+curl -sk https://localhost:10250/pods/
+# Unauthorized
+
+curl -sk https://localhost:10250/pods/ --key /etc/kubernetes/pki/apiserver-kubelet-client.key --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt
+# {"kind":"PodList","apiVersion":"v1","metadata":{},"items":[{"metadata":{"name":"etcd-controlplane","namespace": ...
+```
-Original file line number
+Diff line change
@@ Expand Up / @@ -6,7 +6,7 @@ @@
     <br />
-    Refer [RBAC](../rbac.md)
+    Refer [RBAC](../topics/rbac.md)
     <br />
@@ Expand All @@
     <br />
+    TBD
+    <br />
     ## Perform a version upgrade on a Kubernetes cluster using Kubeadm
     <br />
@@ Expand Down @@