KOPS - CKS
type: channel
link: https://www.kops.cc/tag/CKS/
items: CKS 1.22 模拟题

CKS 1.22 模拟题
type: item
date: 2021-12-14T02:44:00+00:00
description: Question 1Task weight: 1%You have access to multiple clusters from your main terminal through kubectl contexts. Write all context names into /opt/course/1/contexts, one per line.From the kubeconfig extract the certificate of user restricted@infra-prod and write it decoded to /opt/course/1/cert.题目解析：考点kubectl解题➜ kubectl config get-contexts -o name > /opt/course/1/contexts # 从 .kube/config 文件中找到 - name: restricted@infra-prod user client-certificate-data: LS0tLS1CRUdJ... ➜ echo LS0tLS1CRUdJ... | base64 -d > /opt/course/1/certQuestion 2Task weight: 4%Use context: kubectl config use-context workload-prodFalco is installed with default configuration on node cluster1-worker1. Connect using ssh cluster1-worker1. Use it to:Find a Pod running image nginx which creates unwanted package management processes inside its container.Find a Pod running image httpd which modifies /etc/passwd.Save the Falco logs for case 1 under /opt/course/2/falco.log in format time,container-id,container-name,user-name. No other information should be in any line. Collect the logs for at least 30 seconds.Afterwards remove the threads (both 1 and 2) by scaling the replicas of the Deployments that control the offending Pods down to 0.题目解析：考点falco解题通过 falco 日志查找容器 ID, PODFind a Pod running image nginx which creates unwanted package management processes inside its container➜ ssh cluster1-worker1 ➜ root@cluster1-worker1:~# grep nginx /var/log/syslog | grep -i "package management process" Dec 13 01:03:23 cluster1-worker1 falco[28640]: 01:03:23.564163340: Error Package management process launched in container (user=root user_loginuid=-1 command=apk container_id=3ed4079e7f61 container_name=nginx image=docker.io/library/nginx:1.19.2-alpine) ... ➜ root@cluster1-worker1:~# crictl ps -id 3ed4079e7f61 CONTAINER ID IMAGE NAME ... POD ID 3ed4079e7f61 6f715d38cfe0e nginx ... 7a864406b9794 ➜ root@cluster1-worker1:~# crictl pods -id 7a864406b9794 POD ID ... NAME NAMESPACE ... 7a864406b9794 ... webapi-6cfddcd6f4-ftxg4 t…