Skip to content
CKSMinimize Microservice VulnerabilitiesSingle nodeMedium

Isolation: remove host namespaces and privileged mode

Scenario cks-mic-004 · about 8 minutes · 9 points · 8 grader checks

A tenant workload shares the node's network, PID and IPC namespaces, runs privileged and mounts the host; isolate it and enforce baseline.

  • isolation
  • multi-tenancy
  • host-namespaces
  • privileged
  • pod-security-admission

What you will practise

  • Recognise hostNetwork, hostPID, hostIPC, privileged and hostPath as isolation breaks
  • Fix a pod template in place
  • Enforce the baseline Pod Security Standard

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-mic-004

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Namespace "tenant-b" is shared with other tenants. Its Deployment "legacy" (container "legacy", image busybox:1.36) breaks out of the container isolation: it uses the host network, PID and IPC namespaces, runs privileged and mounts the node's root filesystem. 1. Edit the Deployment "legacy" (do not recreate it) so that its pods use none of the host namespaces, are not privileged and mount no hostPath volume. Keep the container, image and command. 2. Make Pod Security Admission enforce the "baseline" level on "tenant-b" so such pods are rejected from now on. The Deployment's replica must be Ready with the new pod template.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Minimize Microservice Vulnerabilities
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
9
Grader checks
8
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Minimize Microservice Vulnerabilities labs

CKSMinimize Microservice VulnerabilitiesMedium

Pod Security Admission: enforce restricted

Enforce the restricted Pod Security Standard on a namespace and bring a non-compliant Deployment into line without recreating it.

Single node · ~9 min · 9 points

  • pod-security-admission
  • pod-security-standards
  • restricted
  • securitycontext
  • seccomp

goldenkube start cks-mic-001

CKSMinimize Microservice VulnerabilitiesHard

Encrypt Secrets at rest in etcd

Write an EncryptionConfiguration, wire it into the API server static pod and rewrite an existing Secret so etcd holds it encrypted.

Single node · ~10 min · 8 points

  • secrets
  • encryption-at-rest
  • etcd
  • kube-apiserver
  • static-pod

goldenkube start cks-mic-002

CKSMinimize Microservice VulnerabilitiesMedium

Secrets: from environment variables to a read-only volume

Move a Secret from an environment variable to a read-only volume with restrictive file mode and make the Secret immutable.

Single node · ~8 min · 9 points

  • secrets
  • immutable
  • volumes
  • deployment
  • least-privilege

goldenkube start cks-mic-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.