Please enable JavaScript.

Coggle requires JavaScript to display documents.

Certified Kubernetes Security Specialist - Coggle Diagram

- - - - Enable Apparmor Profile i.e : docker-default
        at each node(where we need more control)
        
        Add the annotation to each pod for the required container
        <annotation -key >/<container_name>: <node-name>/<profile-name>
        
        check : '''crictl inspect CONTAINER-ID | grep apparmor.```
    - - Seccom has to be set in the kubelete ,
        
        Seccomp can be set inside the SecurityContext
- - - - privilegedEscalation
      - Privileged
    - - PSP is a Admission Webhook,
        
        Must be enabled at kube-api
        
        It's cluster resource needs to be created by Admin
        
        The ServiceAccount / User must have RBAC to access it
        If enabled and creator of pod doesn't have access then pod won't be created
- - - - k get deploy -n <namespace> -o custom-columns=NAME:.metadata.name,NS:.metadata.namespace,IMAGE:.spec.template.spec.containers[*].image trivy image httpd:2.4.39-alpine | grep -E "CVE-123|CVE-789" k scale --replicas=0 deployment -n <namespace> <deployment-name>
  - - - Configure the kube-api
        --enable-admission-plugins=ImagePolicyWebhook
        
        --admission-control-config-file=/etc/kubernetes/policywebhook/admission_config.json
        
        Mount the file
        
        admission config file:
        
        clusters
        
        contexts
        
        users
- - - - falco service status
        
        falco log dir
        
        falco rules and attributes in that
  - - - Configuration Drift
        
        securityContext allowPrivilegeEscalation=false privileged=false readOnlyRootFilesystem=true runAsUser=<non-root> capabilities CAP_SYS_ADMIN XXX NO