Correct Answer:

Solution:

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a NetworkP01icy:
- Create a NetworkPolicy YAML file to define the traffic rules:

2. Apply the NetworkPolicy: - Apply tne NetworkPoliCY configuration to your Kubernetes cluster: basn kubectl apply -f restrict-microservice-traffic_yaml 3. Test the NetworkPoIicy: - Create a pod in a different namespace or on a different node. - Attempt to connect to the microservice pod from the new pod. - Verity that the connection is blocked as per the defined NetworkPolicy rules.

Correct Answer:

See the Explanation below for complete solution.
Explanation:
ssh ckad00029
You must modify the existing Deployment store-deployment in namespace grubworm so that its containers:
* run as user ID 10000
* have Linux capability NET_BIND_SERVICE added
And you're told to use the manifest file at:
/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looks misspelled; follow it exactly on the host)
1) Inspect the current Deployment and locate the manifest file
kubectl -n grubworm get deploy store-deployment
ls -l /home/candidate/daring-moccasin/
Open the manifest:
sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"
2) Edit the manifest to add SecurityContext
Edit the file:
vi "/home/candidate/daring-moccasin/store-deplovment.vaml"
2.1 Set Pod-level runAsUser = 10000
Under:
spec.template.spec add:
securityContext:
runAsUser: 10000
2.2 Add NET_BIND_SERVICE capability at container-level
Under the container spec (for each container in containers:), add:
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
A complete example of what it should look like (mind indentation):
apiVersion: apps/v1
kind: Deployment
metadata:
name: store-deployment
namespace: grubworm
spec:
template:
spec:
securityContext:
runAsUser: 10000
containers:
- name: store
image: someimage
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
Important notes:
* runAsUser can be set at Pod level (applies to all containers) or per-container. Pod-level is cleanest if all containers should run as 10000.
* Capabilities must be set per-container (that's where Kubernetes supports it).
Save and exit.
3) Apply the updated manifest
kubectl apply -f "/home/candidate/daring-moccasin/store-deplovment.vaml"
4) Ensure the Deployment rolls out
kubectl -n grubworm rollout status deploy store-deployment
5) Verify the settings are in effect
Check the rendered pod template:
kubectl -n grubworm get deploy store-deployment -o jsonpath='{.spec.template.spec.securityContext}{"\n"}' kubectl -n grubworm get deploy store-deployment -o jsonpath='{.spec.template.spec.containers[0].
securityContext}{"\n"}'
Verify on a running pod:
kubectl -n grubworm get pods
kubectl -n grubworm describe pod <pod-name> | sed -n '/Security Context:/,/Containers:/p' kubectl -n grubworm describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p' If there are multiple containers Repeat the container-level securityContext.capabilities.add block for each container under spec.template.spec.
containers.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
I). Create a PodSecurityPoIicy:
- Create a YAML file for your P0dSecurityP01icy.
- Define the 'apiVersion' and 'kind'
- Add a 'metadata' section with a unique name for the policy (e.g., 'payment-service-psp').
- In the 'spec' section:
- Set 'runAsUser' to ' RunAsAny' to allow any user ID.
- Set readOnlyRootFilesystem' to 'talse' to allow modifications within the container.
- Set 'hostNetworR to 'false' to avoid using the host's network.
- Set 'allowPrivilegeEscalatiorU to 'false' to prevent privilege escalation.
- In the 'volumes' sectiom
- Define 'hostPath' as the allowed volume type with the specified path "Isensitive-data'

2. Apply the PodSecurityPolicy: - Use ' kubectl apply -f payment-service-psp.yamr to create the PodSecurityPoIicy in your cluster. 3. Create a ServiceAccount: - Create a new ServiceAccount tor the 'payment-service deployment. - Apply the ServiceAccount YAML file using 'kubectl apply -f payment-service-sa_yamr 4. Bind the PodSecurityPolicy to the ServiceAccount: - Create a RoleBinding to bind the 'payment-service-psp' to the 'payment-service' ServiceAccount - Apply the RoleBinding YAML file using "kubectl apply -f payment-service-rb.yaml'

5. Deploy the Payment Service: - Create the 'payment-service' Deployment configuration. - Specify the 'payment-service' ServiceAccount in the field. - Define the 'volumeMount tor the 'sensitive-data' volume and specify the corresponding 'volume' in the 'volumes' section. - Ensure the volume is mounted as a Secret from the 'default' namespace.

- The PodSecurityPolicy restricts the benavior of pods and their containers. - 'runAslJser' , 'readOnlyRootFilesystem', 'hostNetwork' , and sallowPrivilegeEscalation' define various security constraints for the container. - The 'volumes' section specifies allowed volume types (e.g., 'hostPath') and paths. - The ServiceAccount binds the PodSecurityPolicy to the deployment. - The ROIeBinding assigns the PodSecurityPolicy to the ServiceAccount, effectively enforcing the specified constraints. This configuration ensures that only the payment-service' deployment can access the confidential data volume mounted as a Secret in Kubernetes.