Skip to content
CKSMinimize Microservice VulnerabilitiesSingle nodeMedium

Pod Security Admission: enforce restricted

Scenario cks-mic-001 · about 9 minutes · 9 points · 9 grader checks

Enforce the restricted Pod Security Standard on a namespace and bring a non-compliant Deployment into line without recreating it.

  • pod-security-admission
  • pod-security-standards
  • restricted
  • securitycontext
  • seccomp

What you will practise

  • Configure Pod Security Admission with namespace labels
  • Know the restricted profile requirements
  • Fix a pod template so the restricted level admits it

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-mic-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Namespace "team-a" must follow the Pod Security Standard "restricted". 1. Label the namespace so that Pod Security Admission enforces the "restricted" level and also warns about "restricted" violations (use the "latest" version). 2. The Deployment "app" in "team-a" (container "app", image busybox:1.36, command "sleep 360000") currently runs as root and does not comply. Edit it (do not recreate it) so that its pods are admitted under "restricted": - run as user ID 1000 and as non-root; - no privilege escalation; - drop ALL capabilities; - seccomp profile RuntimeDefault. The Deployment's replica must be Ready with the new pod template.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Minimize Microservice Vulnerabilities
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
9
Grader checks
9
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 9 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Minimize Microservice Vulnerabilities labs

CKSMinimize Microservice VulnerabilitiesHard

Encrypt Secrets at rest in etcd

Write an EncryptionConfiguration, wire it into the API server static pod and rewrite an existing Secret so etcd holds it encrypted.

Single node · ~10 min · 8 points

  • secrets
  • encryption-at-rest
  • etcd
  • kube-apiserver
  • static-pod

goldenkube start cks-mic-002

CKSMinimize Microservice VulnerabilitiesMedium

Secrets: from environment variables to a read-only volume

Move a Secret from an environment variable to a read-only volume with restrictive file mode and make the Secret immutable.

Single node · ~8 min · 9 points

  • secrets
  • immutable
  • volumes
  • deployment
  • least-privilege

goldenkube start cks-mic-003

CKSMinimize Microservice VulnerabilitiesMedium

Isolation: remove host namespaces and privileged mode

A tenant workload shares the node's network, PID and IPC namespaces, runs privileged and mounts the host; isolate it and enforce baseline.

Single node · ~8 min · 9 points

  • isolation
  • multi-tenancy
  • host-namespaces
  • privileged
  • pod-security-admission

goldenkube start cks-mic-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.