궁금한게 많은 개발자 노트

The namespace qa-environment has been configured to enforce the baseline Pod Security Standard profile. There is an existing Deployment named legacy-service in the qa-environment namespace, but none of its Pods are currently running.Inspect the underlying issue preventing the Pods from being created. Modify the Deployment configuration appropriately so that it complies with the baseline Pod Secu..

A recent security audit revealed several vulnerabilities in the container runtime configuration on node cks-node-01. To secure the host environment, implement the following hardening measures:1. Remove the user bob from the secondary group docker to prevent unauthorized root access.2. Restrict access to the Docker daemon socket file located at /var/run/docker.sock by changing its owner and group..

1. Create an EncryptionConfiguration file at /etc/kubernetes/etcd/ec.yaml and make the apiserver use it.2. One provider should be of type aesgcm with password this-is-very-sec . All new secrets should be encrypted using this one.3. One provider should be the identity one to still be able to read existing unencrypted secrets. [ 포함된 개념 ]Encryption at Rest: 쿠버네티스의 모든 상태 정보(Secret 포함)는 etcd라는 Key-Va..

Context: You have access to the controlplane node.Task: Secure the cluster deployment pipeline by enabling the ImagePolicyWebhook admission controller to reject unverified images.1. An admission configuration file is available at /etc/kubernetes/admission/admission-config.yaml. Edit this file to ensure that if the external webhook server is unreachable or fails, the admission controller defaults..

Context: You have access to the controlplane node.Task: Configure the Kubernetes API Server to log auditing events based on a specific policy. 1. Create an audit policy file at /etc/kubernetes/audit/policy.yaml with the following rules: - Log all requests for ingresses resources in the networking.k8s.io API group at the Metadata level. - Log create, update, and delete requests for deployments an..