Hao DevSecOps

Task weight: 4% Use context: kubectl config use-context k8s-c1-H Create a Pod named multi-container-playground in Namespace default with three containers, named c1 , c2 and c3 . There should be a volume attached to that Pod and mounted into every container, but the volume shouldn’t be persisted or shared with other Pods. Container c1 should be of image nginx:1.17.6-alpine and have the name of the node where its Pod is running available as environment variable MY_NODE_NAME. Container c2 should...

Use context: kubectl config use-context k8s-c1-H Use Namespace project-tiger for the following. Create a Deployment named deploy-important with label id=very-important (the Pods should also have this label) and 3 replicas. It should contain two containers, the first named container1 with image nginx:1.17.6-alpine and the second one named container2 with image kubernetes/pause . There should be only ever one Pod of that Deployment running on one worker node. We have two worker nodes: cluster1-...

Use context: kubectl config use-context k8s-c1-H Use Namespace project-tiger for the following. Create a DaemonSet named ds-important with image httpd:2.4-alpine and labels id=ds-important and uuid=18426a0b-5f59-4e10-923f-c0e078e82462 . The Pods it creates should request 10 millicore cpu and 10 mebibyte memory. The Pods of that DaemonSet should run on all nodes, also controlplanes. 译文在命名空间 project-tiger 进行如下操作。创建一个名为 ds-important 的 DaemonSet ，镜像为 httpd:2.4-alpine ，标签 id=ds-important ， uuid...

Use context: kubectl config use-context k8s-c1-H Create a new ServiceAccount processor in Namespace project-hamster . Create a Role and RoleBinding, both named processor as well. These should allow the new SA to only create Secrets and ConfigMaps in that Namespace. 译文在namespace project-hamster 中创建一个新的 ServiceAccount processor 。创建一个 角色 和 RoleBinding ，这两个都是命名的 processor 。这些应该允许新的 SA 只在该命名空间中创建 Secrets 和 ConfigMaps 。 解答 有4种不同的RBAC组合和3种有效的组合。 Role + RoleBinding（适用于单一命名空间，适用于单个命名空间） ClusterRo...

Use context: kubectl config use-context k8s-c2-AC Ssh into the controlplane node with ssh cluster2-controlplane1 . Temporarily stop the kube-scheduler, this means in a way that you can start it again afterwards. Create a single Pod named manual-schedule of image httpd:2.4-alpine , confirm it’s created but not scheduled on any node. Now you’re the scheduler and have all its power, manually schedule that Pod on node cluster2-controlplane1. Make sure it’s running. Start the kube-scheduler aga...

Use context: kubectl config use-context k8s-c1-H Ssh into the controlplane node with ssh cluster1-controlplane1 . Check how the controlplane components kubelet, kube-apiserver, kube-scheduler, kube-controller-manager and etcd are started/installed on the controlplane node. Also find out the name of the DNS application and how it’s started/installed on the controlplane node. Write your findings into file /opt/course/8/controlplane-components.txt . The file should be structured like...

Use context: kubectl config use-context k8s-c1-H The metrics-server has been installed in the cluster. Your college would like to know the kubectl commands to: show Nodes resource usage show Pods and their containers resource usage Please write the commands into /opt/course/7/node.sh and /opt/course/7/pod.sh . 译文在集群中已经安装了metrics-server。你们学院想知道使用 kubectl 的命令获取如下信息。 显示节点资源使用情况 显示Pod和其容器的资源使用情况 请将这些命令写入/opt/course/7/node.sh 和 /opt/course/7/pod.sh 。 解答参考: kubectl top node -h kubectl top pod...

Use context: kubectl config use-context k8s-c1-H Create a new PersistentVolume named safari-pv . It should have a capacity of 2Gi , accessMode ReadWriteOnce , hostPath /Volumes/Data and no storageClassName defined. Next create a new PersistentVolumeClaim in Namespace project-tiger named safari-pvc . It should request 2Gi storage, accessMode ReadWriteOnce and should not define a storageClassName. The PVC should bound to the PV correctly. Finally create a new Deployment safari in Namespace ...

Use context: kubectl config use-context k8s-c1-H There are various Pods in all namespaces. Write a command into /opt/course/5/find_pods.sh which lists all Pods sorted by their AGE ( metadata.creationTimestamp ). Write a second command into /opt/course/5/find_pods_uid.sh which lists all Pods sorted by field metadata.uid . Use kubectl sorting for both commands. 译文在所有命名空间中都有各种Pod。在 /opt/course/5/find_pods.sh 中写一条命令，列出所有按AGE metadata.createTimestamp 排序的Pod。在 /opt/course/5/find_pods_uid.sh 中编写第...

Task weight: 4% Use context: kubectl config use-context k8s-c1-H Do the following in Namespace default. Create a single Pod named ready-if-service-ready of image nginx:1.16.1-alpine . Configure a LivenessProbe which simply executes command true . Also configure a ReadinessProbe which does check if the url http://service-am-i-ready:80 is reachable, you can use wget -T2 -O- http://service-am-i-ready:80 for this. Start the Pod and confirm it isn’t ready because of the ReadinessProbe. Create a...