CKS Exam prep (Part 1)
Tags: kubernetes
Published: 2023-03-06 06:09:16

Run CIS Standard tests in your server:


Situation:


`We have installed the CIS-CAT Pro Assessor tool called Assessor-CLI, under /root.

Please run the assessment with the Assessor-CLI.sh script inside Assessor directory and generate a report called index.html in the output directory /var/www/html/.Once done, the report can be viewed using the Assessment Report tab located above the terminal.

Run the test in interactive mode and use below settings:

Benchmarks/Data-Stream Collections: : CIS Ubuntu Linux 20.04 LTS Benchmark v1.1.0

Profile : Level 1 - Server
`

Code to run:

```
cd /root/Assessor
sh ./Assessor-CLI.sh -i -rd /var/www/html/ -nts -rp index
```
This might be an output:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/00quc84mqp59rmc6f7c8.png)

Alternate to CIS best practices is kube bench

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6dyxi64mzk4e5x3dbb1v.png)

Here you can see what CIS shows in right side and what kube bench shows in the right side in a terminal. Almost the same.

Install Kube bench in your system:

```
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.4.0/kube-bench_0.4.0_linux_amd64.tar.gz -o kube-bench_0.4.0_linux_amd64.tar.gz

tar -xvf kube-bench_0.4.0_linux_amd64.tar.gz
```

Run this command to check :

```
 ./kube-bench --config-dir `pwd`/cfg --config `pwd`/cfg/config.yaml 
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e6npm4ziqbqlil9on9rr.png)


**Authentication**
There are basically 2 types of users that can try to get admin access.

1. Users (Developers or admin himself)
2. Service accounts (for integration purposes services accounts can try to access)

But we can not create user account in kubernetes, rather service accounts.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xx46qekgu2xo4ckqfr8e.png)

**User access manage**
So, all of the requests go through kubeapi server.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uqazd2p3f4ozoisephw0.png)
Then it's processed.

There are multiple ways to authenticate kubeapi authentication process:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y96uz3mmced2pwi2yw8u.png)

1. Static password file:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6bhn6dlsv1p1duazjw5e.png)
You can create a csv file with password,username, userid
 
Then you can pass the file name as basic-auth-file

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mfhp746eo5i10ll1l9uq.png)
Then you can set it by adding it to containers or if you were using pods, you can add that place too.

or,

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pcgzc1pa3q9u24t9rj7a.png)

Now to authenticate, use username and password like this


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m7lknplbuy1w8jgac21t.png)

2. Static token file:
The token file is almost the same as the password file.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4e5ybvg3do9uxsyeue1t.png)
Pass the token file

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ajzbv8hsfsug4gtbff7u.png)
Then curl it like this

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2r9ewroecgf07lj1ggig.png)
3. Service accounts:
Generally used by robots or bots for integration.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09bj8ruip4nlnn969xs2.png)
Prometheus, Jenkins use service accounts.

Now we have created a dashboard using python , which uses kubeapi to retrieve all of the pod lists. And publish all in a website.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hcp49qqn8fkcbd6gltwo.png)
Inorder to contact kube-api, our website uses a service account.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adsmw7rk6lxs1gzskgud.png)

To create and view service accounts, we use these commands:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c1uk4ioa1m4rbnhm3ank.png)
While the service account is created, it also creates a token.
This token is needed to contact or authenticate with the kube-api. Basically this token saves the secret id.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o6ld14fvl101za2mrun9.png)


You can view the secret token id by this:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ft6jkqp3zwxikciqkd95.png)

Once you know the secret token id, you can use it as authentication token.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2qbltc2df15y3tosuc43.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ngqk2g986n30ay7ddpbj.png)

**Default service accounts**

Every namespace creates a default service account to authenticate with kubeapi.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y3d7hqb5tmjv7b5l4a6r.png)


Assume we have a an image and we will use it to run a pod.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qfz3fhzv0bgnow6oyxaa.png)
Once created, if you see the details, you can see that under descriptions, we have volumes.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zwjzg4a9tcm8w6vx6ry7.png)
Here you can see a secret token. This token stores the secret token id used for authentication purpose.

Summary: Every service account thus uses a token where it stores token id to authenticate with kubeapi.
Once we check out the file location of the token, you can see this token.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m2x0icxggk5h3i6fwbta.png)

But default service account can not perform a lot of tasks.
So, to use it in our pod, you have to add it in the pod definition.
As we had "dashboard-sa" service account, we are now adding it to our new pod.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6wfafkzh85urzlq88uci.png)
Now if you check out the pod details, you can see that new service account is used.

How did you know?
Check out the volume with "dashboard-sa-token-.." . This means that our "dashboard-sa" service account has created this token to communicate.
Also you can stop the auto mount of a service by setting it to false as it is true by default.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gfzefc20ymm0vwh1rzpq.png)


Updates (Release 1.22-1.24):
Once we create a pod, a service account is automatically added and kept in a good location.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7twvinn1q2i1rwzjnn26.png)
Then you can check out the token too.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1f41ekajx3obx3hecanx.png)

From 1.22 release, tokenrequestapi has been launched which will ensure that token ids have time limits (time bound) so that it expires after a certain time and can not be used by hackers.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ugn3llql25wzkznzciua.png)
Now when we create a pod, it does not rely on service account tokens rather token by TokenRequestAPI.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tbu61ydifzzd3whu7mjf.png)
It's added as a projected volume.

1.24 release:
When you used to create a service account, it would create a token by default but from 1.24 , you have to create it of your own.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x93xmhufw05rpcj9el14.png)
ONce you know the token, you can decode it and know all informations

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v2mk33oa13s42ij7oemf.png)

Here ""eyJH........." is the token. YOu can use this [jwt](https://jwt.io/) to decode keys
You can still create secret token in a service account by doing this in the service account's yml file . Here this token won't expire. (Not recommended)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/idu42z7t25xrvhc9z9ff.png)

Suggestions:
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jb957olq16bl5ds3uidk.png)


**TLS Certificates**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gizd6ynhe9kbwre3epvo.png)

So, our Kubeapi generates these 2 certificates.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h6i1urze6he4p1wcq65r.png)
Also we have for etcd server and kubelet.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qbjjkaaqi9ix3jlgxm4r.png)
But outside of Kubernetes, there are others which needs these certificates.
For example, the admins, kubescheduler, kube control manager, kubeproxy and so on.
Everyone generates a public and private key and then use adds a certificate with the public key.

Then it's ready to contact the kubeapi server for all our needs.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9mj8wpx35o64wgmjmlne.png)
After that kubeapi contact etcd and kubelet.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z4n4pmaoo5gcx3xslaqy.png)
If needed, it generated new pair of keys to contact etcd and kubelet.

Now we will need CAs to generate certificates.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m37o354fdvr5bcjnmypy.png)

Even the CAs themselves need keys.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/upww85skk63ijzl31we7.png)


**Generating certificates using OpenSSL for itself ( OpenSSL is one of the CAs)**
First we generate keys and then request for a sign and then get it signed by the openssl.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8k9k07jqh6mdkrcxfxfc.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ywz5d8l2fcmlw0agv1qq.png)

So, we have successfully generated certificates for CA itself. Now we can use it to generate for others.

In the same way, we can create a certificate for our admin user but, we have to get it signed by the CA.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x926lee0moggpozve12i.png)

Thus in the last step, we have used ca.crt and ca.key


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6zpg3gewaz6v94zf90t8.png)


We can also add them to a group for admin access.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1dxfcklkua4be5hndy86.png)

Almost same process for the Kube control manager 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bf2jir3oh1temldwm1gq.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/35madoohkehsh046nd5g.png)
Done with these certificates.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oti36yic5xieuu2ttss1.png)
 
So, instead of a user name and  password, if we know these keys, we can access it using admin key, admin certificate and ca certificate.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6ylqpqhxm6yxjelpipib.png)
We have generated these keys in the previous steps.
or, you can create a config file to store all of these info and then use it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j81c1dbiayxqkj2i5bsz.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i6oxq3s8ihqf2mbltc1b.png)
This is how we can generate it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tyb8oxk5rfwx9rbmtaew.png)
For kubectl certificates, we go through this process as well.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ubrnn9utzs2jo6ai9b6r.png)

Let's do some labs:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/53sr8x8osbs00z134of9.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mgtqo20pydigkxaz8q07.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h5oxc866p8yk91n5s5qw.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jw29r297bz7eycqbhx28.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gz2mmxzealcz2rjfae4m.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yl22luree0pv7cnbcgzt.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3ej7kib36f5xtm7hqich.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2aw2syx53bkhl73birfc.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pihj7se99j1p3g4lycce.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/45jpuas9t8leebrkn19a.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/moqea357udnu810ow7kh.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/099y93k2o6y0actsqv39.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kjefsk0d983hry23v64d.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/or0japypyf3gydy7iw4d.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3nbmydxjabtri75xk6hu.png)

That was it for this blog. See you in the part 2