CKS Dumps with Practice Exam Questions Answers

$ k get ns qa --show-labels

• uk.co.certification.simulator.questionpool.PList@2ef53530

$ k get pods -n dev --show-labels

• uk.co.certification.simulator.questionpool.PList@2ef53680

[desk@cli] $ k get ns qa --show-labels

NAME STATUS AGE LABELS

qa Active 47m env=stage

[desk@cli] $ k get pods -n dev --show-labels

NAME READY STATUS RESTARTS AGE LABELS

product 1/1 Running 0 3s env=dev-team

[desk@cli] $ vim netpol2.yaml

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: restricted-policy

namespace: dev

spec:

podSelector:

matchLabels:

env: dev-team

policyTypes:

- Ingress

ingress:

- from:

- namespaceSelector:

matchLabels:

env: stage

- podSelector:

matchLabels:

env: stage

• Install the Runtime Class for gVisor

{# Step 1: Install a RuntimeClass

cat <

apiVersion: node.k8s.io/v1beta1

kind: RuntimeClass

metadata:

name: gvisor

handler: runsc

EOF

}

• Create a Pod with the gVisor Runtime Class

{ # Step 2: Create a pod

cat <

apiVersion: v1

kind: Pod

metadata:

name: nginx-gvisor

spec:

runtimeClassName: gvisor

containers:

- name: nginx

image: nginx

EOF

}

• Verify that the Pod is running

{ # Step 3: Get the pod

kubectl get podnginx-gvisor -o wide

}

A service account provides an identity for processes that run in a Pod.

When you (a human) access the cluster (for example, using kubectl), you are authenticated by the apiserver as a particular User Account (currently this is usually admin,unless your cluster administrator has customized your cluster). Processes in containers inside pods can also contact the apiserver. When they do, they are authenticated as a particular Service Account (for example, default).

When you create a pod, if youdo not specify a service account, it is automatically assigned the default service account in the same namespace. If you get the raw json or yaml for a pod you have created (for example, kubectl get pods/ -o yaml), you can see the spec.serviceAccountName field has been automatically set.

You can access the API from inside a pod using automatically mounted service account credentials, as described in Accessing the Cluster. The API permissions of the service account depend on the authorization plugin and policy in use.

In version 1.6+, you can opt out of automounting API credentials for a service account by setting automountServiceAccountToken: false on the service account:

apiVersion:v1

kind:ServiceAccount

metadata:

name:build-robot

automountServiceAccountToken:false

In version 1.6+, you can also opt out of automounting API credentials for a particular pod:

apiVersion:v1

kind:Pod

metadata:

name:my-pod

spec:

serviceAccountName:build-robot

automountServiceAccountToken:false

The pod spec takes precedence over the service account if both specify a automountServiceAccountToken value.

[controlplane@cli] $ k get pods -n nato -o yaml | grep "image: "[controlplane@cli] $ trivy image [controlplane@cli] $ k delete pod -n nato

[desk@cli] $ ssh controlnode[controlplane@cli] $ k get pods -n nato

NAME READY STATUS RESTARTS AGE

alohmora 1/1 Running 0 3m7s

c3d3 1/1 Running 0 2m54s

neon-pod 1/1 Running 0 2m11s

thor 1/1 Running 0 58s

[controlplane@cli] $ k get pods -n nato -o yaml | grep "image: "

Text Description automatically generated[controlplane@cli] $ trivy image Text Description automatically generatedText Description automatically generatedText Description automatically generatedNote: As there are 2 images have vulnerability with severity Hight & Critical. Delete containers for nginx:latest & alpine:3.7

[controlplane@cli] $ k delete pod thor -n nato