cks

Tips:

Always make sure that volume is mounted when you do any chnages in the kubeAPI server.

setup your environment:

export do="--dry-run=client -o yaml"     # k create deploy nginx --image=nginx $do
export now="--force --grace-period 0"    # k delete pod x $now

containerd

containerd cli tool:

crictl ps

ETCD

Flag	Protocol	IP	Port
--etcd-servers=	https://	127.0.0.1:	2379

AppArmor

Check AppArmor status:

apparmor_status

Audit

Create a folder for storing logs. Add volumeMounts and volumes in the kube-apiserver config file.

kube-bench

see all:

kube-bench run --targets master

or just see the one:

kube-bench run --targets master --check 1.2.20

RuntimeClass

The handler for the gVisor RuntimeClass is runsc:

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor 
handler: runsc

RBAC

Create role:

kubectl -n applications create role smoke --verb=create,delete --resource=pods,deployments,statefulsets

Create rolebinding:

kubectl -n applications create rolebinding smoke --role=smoke --user=smoke

Create view only roles for user smoke:

kubectl -n applications create rolebinding smoke-view --clusterrole view --user smoke
kubectl -n default create rolebinding smoke-view --clusterrole view --user smoke
kubectl -n kube-node-lease create rolebinding smoke-view --clusterrole view --user smoke
kubectl -n kube-public create rolebinding smoke-view --clusterrole view --user smoke

ShubhamTatvamasi/cks

cks