CKS Prüfung: Kubernetes Security Specialist werden

# kube-bench: CIS Kubernetes Benchmark pruefen
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench
# Typischer Fix: --profiling=false in kube-apiserver.yaml

# RBAC testen
kubectl auth can-i create deployments \
  --as=system:serviceaccount:production:deploy-sa -n production

# Default-ServiceAccount einschraenken
kubectl patch serviceaccount default -n production \
  -p '{"automountServiceAccountToken": false}'

# Least-Privilege Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployment-manager
  namespace: production
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployment-manager-binding
  namespace: production
subjects:
  - kind: ServiceAccount
    name: deploy-sa
    namespace: production
roleRef:
  kind: Role
  name: deployment-manager
  apiGroup: rbac.authorization.k8s.io

# Pod mit AppArmor-Profil
apiVersion: v1
kind: Pod
metadata:
  name: apparmor-pod
  annotations:
    container.apparmor.security.beta.kubernetes.io/app: localhost/k8s-restricted
spec:
  containers:
    - name: app
      image: nginx:1.27
---
# Pod mit Seccomp und gehaertetem SecurityContext
apiVersion: v1
kind: Pod
metadata:
  name: hardened-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: nginx:1.27
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 10000
        capabilities:
          drop:
            - ALL
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir: {}

# AppArmor-Profil auf dem Node laden
apparmor_parser -q /etc/apparmor.d/k8s-restricted
aa-status  # aktive Profile anzeigen

# Namespace mit Pod Security Standard (restricted)
apiVersion: v1
kind: Namespace
metadata:
  name: secure-apps
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

# OPA Gatekeeper: Image-Allowlist erzwingen
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sallowedrepos
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedRepos
      validation:
        openAPIV3Schema:
          type: object
          properties:
            repos:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sallowedrepos
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          satisfied := [good | repo = input.parameters.repos[_] ; good = startswith(container.image, repo)]
          not any(satisfied)
          msg := sprintf("image <%v> not from allowed repo", [container.image])
        }

# Image scannen
trivy image nginx:1.27

# Nur kritische und hohe Schwachstellen
trivy image --severity CRITICAL,HIGH nginx:1.27

# Filesystem scannen
trivy fs /path/to/project

# Kubernetes-Cluster scannen
trivy k8s --report summary cluster

# Kubernetes Audit Policy
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["secrets"]
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods", "services"]
  - level: None
    nonResourceURLs:
      - "/healthz*"
      - "/readyz*"

# Audit Policy aktivieren (kube-apiserver.yaml):
# --audit-policy-file=/etc/kubernetes/audit/policy.yaml
# --audit-log-path=/var/log/kubernetes/audit/audit.log
# --audit-log-maxage=30

# Falco-Output pruefen
journalctl -u falco -f

# Verdaechtige Prozesse in Containern finden
kubectl exec suspect-pod -- ps aux
crictl ps
crictl inspect CONTAINER_ID