Kubernetes Security reading list

echo "set ai et sw=2 ts=2 sts=2" > ~/.vimrc

:vert term

# list all rules
falco -L

shasum: standard input: no properly formatted SHA checksum lines found

echo "$(cat kube-apiserver.sha256)  kube-apiserver" | shasum -a 256 --check

cat sha.txt
sha file

sha512sum -c sha.txt

root@k8s:~# k explain pods.spec | grep -C5 nodeName
    then using the max of of that value or the sum of the normal containers.
    Limits are applied to init containers in a similar fashion. Init containers
    cannot currently be added or removed. Cannot be updated. More info:
    https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

  nodeName      <string>
    NodeName indicates in which node this pod is scheduled. If empty, this pod
    is a candidate for scheduling by the scheduler defined in schedulerName.
    Once this field is set, the kubelet for this node becomes responsible for
    the lifecycle of this pod. This field should not be used to express a desire
    for the pod to be scheduled on a specific node.

root@k8s:~# k explain deployments.spec.template.spec

# it can take a bit till Falco displays output, use falco -U/--unbuffered to speed up
falco -U | grep <>

crictl ps

crictl ps -n1 # show only latest running container

crictl ps -id f86cd629e71c

crictl pods -id cab6dafd045d5

crictl pods --name collector1

crictl inspect <CONTAINER ID>

strace -p 14079 | grep -i kill

bom generate --image registry.k8s.io/kube-apiserver:v1.31.0 --format json --output nginx.spdx.json

trivy image --help | grep format
  $ trivy image --format json --output result.json alpine:3.15
  # Generate a report in the CycloneDX format
  $ trivy image --format cyclonedx --output result.cdx alpine:3.15
  -f, --format string              format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default "table")
...

# create new key for new user
openssl genrsa -out myuser.key 2048
openssl req -new -key myuser.key -out myuser.csr

cat <<EOF > CSR.yaml
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: john-developer # add
spec:
  request: $(cat myuser.csr | base64 | tr -d "\n")
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth
  - digital signature
  - key encipherment
EOF

# View the certificate signing request
openssl req -in new.csr -noout -text

alias kx='f() { [ "$1" ] && kubectl config use-context $1 || kubectl config current-context ; } ; f'
alias kn='f() { [ "$1" ] && kubectl config set-context --current --namespace $1 || kubectl config view --minify | grep namespace | cut -d" " -f6 ; } ; f'

# you can list only pods by field selector (e.g. filter by name) a.k.a emulating grep test
# kubectl get pods | grep test
$ kubectl get pods --field-selector=metadata.name=test
NAME   READY   STATUS    RESTARTS   AGE
test   1/1     Running   0          9h

# based on jsonpath page
$ kubectl get deploy -o=jsonpath='{range .items[*]}{.metadata.name}{" -> "}{..image}{"\n"}{end}'
deploy -> nginx
image-bouncer-webhook -> kainlite/kube-image-bouncer:latest

# based on kubectl quick ref page also works for pods/deployments

$ kubectl get deploy --output=custom-columns="NAME:.metadata.name,IMAGE:..image"
NAME                    IMAGE
deploy                  nginx
image-bouncer-webhook   kainlite/kube-image-bouncer:latest

kubectl get pods -o=custom-columns='N:metadata.name,PSC:..securityContext'

kubectl -n kube-system edit cm kubelet-config

kubeadm upgrade node phase kubelet-config

systemctl restart kubelet

# show k8s versions
k get node

k drain <node-name> --ignore-daemonsets

kubelet --version
kubeadm version

# not necessary because here kubeadm is already installed in correct version
apt-mark unhold kubeadm
apt-mark hold kubectl kubelet
apt install kubeadm=1.34.1-1.1
apt-mark hold kubeadm

kubeadm upgrade plan

kubeadm upgrade apply v1.34.1

# to check it run again
kubeadm upgrade plan

# kubelet and kubectl

apt update
apt show kubelet | grep 1.34.1
apt install kubelet=1.34.1-1.1 kubectl=1.34.1-1.1

apt-mark hold kubelet kubectl

service kubelet restart
service kubelet status

k get node
k uncordon <node-name>