Exam CKS Topic 2 Question 12 Discussion

Solution (Step by Step) :
1. Create a Security Context Constraint (SCC): Create a new SCC named 'non-privileged-sce with the following configuration:
- 'allowPrivilegeEscalation': 'false' (Prevents pods from elevating privileges even if they run with privileged containers)
- 'privileged': 'false' (Disallows containers from running with privileged access)
- 'runAsLJser': ' 1000' (Assigns a specific non-root user ID for containers)
- 'readOnlyRootFilesystem': 'true' (Prevents containers from modifying the host's root filesystem)
- 'seccompProfile': 'localhost/unconfined' (Specifies a seccomp profile for restricting system calls)

2. Apply the SCC: Apply the SCC using 'kuoectl apply -f non-privileged-scc.yaml 3. Create a Second SCC for Privileged Pods: Create a new SCC named 'privileged-sce with the following configuratiom - 'allowPrivilegeEscalation': 'trues - 'privileged': 'true' - 'runAsuser': - 'readOnlyRootFilesystem': 'false' - 'seccompprofile': 'localhost/unconfined'

4. Apply the Privileged SCC: Apply the SCC using 'kubectl apply -f privileged-scc.yaml 5. Update Your Deployment Configurations: - For deployments requiring privileged access, include 'securityContext.securityContextConstraints: privileged-sce within the pod specification. - For all other deployments, include 'securityContext.securityContextConstraints: non-prjvileged-scc' within the pod specification.

6. Restrict Access to SCCs: You can funer enhance security by configuring which users or service accounts can use each SCC. This can be done by using Role-Based Access Control (RBAC) to grant permissions to specific user accounts or service accounts for the SCCs.

This approach ensures that the majority of pods operate with minimal privileges, enhancing security, while allowing a few essential deployments to run with elevated access. Remember to constantly review and update your security policies as your cluster and applications evolve.