CKSKubernetes 1.35

Exercises

Exercise: harden a running Deployment

updated 2026-10-22 by seed

Host: controlplane · Time: 10 min · Domain: System Hardening

Task

Deployment web in prod runs nginx:1.27 as root with no restrictions.

  • It must run as UID 101 (nginx's own user) and never as root.
  • No privilege escalation, all capabilities dropped, no new privileges.
  • Root filesystem read-only, and the Pod must stay Running.

Acceptance criteria

  • kubectl get pod -n prod -l app=web -o jsonpath='{...securityContext}' shows the five fields.
  • The Pod is Running after 60 seconds, not CrashLoopBackOff.
  • kubectl exec into it and touch /x fails.

Solution

    securityContext:
      runAsNonRoot: true
      runAsUser: 101
      runAsGroup: 101
      seccompProfile: {type: RuntimeDefault}
    containers:
    - name: nginx
      image: nginx:1.27
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities: {drop: ["ALL"]}
      volumeMounts:
      - {name: cache, mountPath: /var/cache/nginx}
      - {name: run, mountPath: /var/run}
    volumes:
    - {name: cache, emptyDir: {}}
    - {name: run, emptyDir: {}}

The two emptyDir mounts are what keep nginx alive. Without them: mkdir() "/var/cache/nginx/client_temp" failed (30: Read-only file system).