Exam Environment Setup & Fundamentals

General reference material that doesn’t belong to a single scored domain: exam-day terminal setup and the CKA-level fundamentals the CKS exam assumes you already know.

Terminal Shortcuts/Aliases

The following are useful terminal shortcut aliases/shortcuts to use during the exam.

Add the following to the end of ~/.bashrc file:

alias k='kubectl # <-- Most general and useful shortcut!

alias kd='kubectl delete --force --grace-period=0 # <-- Fast deletion of resources

alias kc="kubectl create" # <-- Create a resource
alias kc-dry='kubectl create --dry-run=client -o yaml # <-- Create a YAML template of resource

alias kr='kubectl run' # <-- Run/Create a resource (typically pod)
alias kr-dry='kubectl run --dry-run=client -o yaml # <-- Create a YAML template of resource

# If kc-dry and kr-dry do not autocomplete, add the following

export do="dry-run=client -o yaml" # <-- Create the YAML tamplate (usage: $do)

The following are some example usages:

k get nodes -o wide
kc deploymentmy my-dep --image=nginx --replicas=3
kr-dry my-pod --image=nginx --command sleep 36000
kr-dry --image=busybox -- "/bin/sh" "-c" "sleep 36000"
kr --image=busybox -- "/bin/sh" "-c" "sleep 36000" $do

Terminal Command Completion

The following is useful so that you can use the TAB key to auto-complete a command, allowing you to not always have to remember the exact keyword or spelling.

Type the following into the terminal:

- kubectl completion bash >> ~/.bashrc`-`kubectl` command completion
- kubeadm completion bash >> ~/.bashrc`-`kubeadm` command completion
- exec $SHELL` - Reload shell to enable all added completion

VIM

The exam will have VIM or nano terminal text editor tools available. If you are using VIM ensure that you create a ~/.vimrc file and add the following:

set ts=2 " <-- tabstop - how many spaces is \t worth
set sw=2 " <-- shiftwidth - how many spaces is indentation
set et " <-- expandtab - Use spaces, never \t values
set mouse=a " <-- Enable mouse support

Or simply:

set ts=2 sw=2 et mouse=a

Also know VIM basics are as follows. Maybe a good idea to take a quick VIM course.

• vim my-file.yaml - If file exists, open it, else create it for editing
• :w - Save
• :x - Save and exit
• :q - Exit
• :q! - Exit without saving
• i - Insert mode, regular text editor mode
• v - Visual mode for selection
• ESC - Normal mode

Pasting Text Into VIM

Often times you will want to paste text or code from the Kubernetes documentation into into a VIM terminal. If you simply do that, the tabs will do funky things.

Do the following inside VIM before pasting your copied text:

1. In NORMAL mode, type :set paste
2. Now enter INSERT mode

• You should see – INSERT (paste) -- at the bottom of the screen

3. Paste the text

• You can right click with mouse and select Paste or CTRL + SHIFT + v

tmux

tmux will allow you to use multiple terminal windows in one (aka terminal multiplexing). Make sure you know the basics for tmux usage:

• tmux- Turn and entertmux
• CTRL + b " - Split the window vertically (line is horizontal)
• CTRL + b % - Split the window horizontally (line is vertical)
• CTRL + b <ARROW KEY> - Switch between window panes
• CTRL + b (hold) <ARROW KEY> - Resize current window pane
• CTRL + b z - Toggle full terminal/screen a pane (good for looking at a full document)
• CTRL + dorexit - Close a window pane

Mouse Support

If you want to be able to click and select within tmux and tmux panes, you can also enable mouse support. This can be useful.

These steps must be done outside of tmux`

1. Create a .tmux.conf file and edit it

   • vim ~/.tmux.conf

2. Add the configuration, save, and exit file

   • set -g mouse on

3. Reload tmux configuration

   • tmux source .tmux.conf

Fundamentals

• You should already have CKA level knowledge
• Linux Kernel Namespaces isolate containers
  • PID Namespace: Isolates processes
  • Mount Namespace: Restricts access to mounts or root filesystem
  • Network Namespace: Only access certain network devices. Firewall and routing rules
  • User Namespace: Different set of UIDs are used. Example: User (UID 0) inside one namespace can be different from user(UID 0) inside another namespace
• cgroups restrict resource usage of processes
  • RAM/Disk/CPU
• Using cgroups and linux kernel namespaces, we can create containers

Understand the Kubernetes Attack Surface

• Kubernetes is a complex system with many components. Each component has its own vulnerabilities and attack vectors.
• The attack surface can be reduced by:
  • Using network policies to restrict traffic between pods
  • Using RBAC to restrict access to the kube-api server
  • Using admission controllers to enforce security policies
  • Using pod security standards to enforce security policies
  • Using best practices to secure the underlying infrastructure
  • Using securityContext to enforce security policies for pods

The 4 C’s of Cloud-Native Security

• Cloud: Security of the cloud infrastructure
• Cluster: Security of the cluster itself
• Container: Security of the containers themselves
• Code: Security of the code itself