【CKS最新模拟真题】根文件系统配置为只读

---

参考地址

容器级别的 securityContext 建议 https://kubernetes.io/zh-cn/docs/concepts/security/application-security-checklist/

---

一、TASK

Solve this question on: ssh cks7262

The Deployment immutable-deployment in Namespace team-purple should run immutable, it’s created from file /opt/course/19/immutable-deployment.yaml on cks7262. Even after a successful break-in, it shouldn’t be possible for an attacker to modify the filesystem of the running container.

Modify the Deployment in a way that no processes inside the container can modify the local filesystem, only /tmp directory should be writeable. Don’t modify the Docker image.

Save the updated YAML under /opt/course/19/immutable-deployment-new.yaml on cks7262 and update the running Deployment

中译
以下位置解决此问题：ssh cks7262
Namespace team-purple中的 Deployment immutable-deployment应该运行不可变，它是从cks7262节点上的/opt/course/19/immutable-deployment.yaml 文件创建的 。即使在成功闯入后，攻击者也应该不可能修改正在运行的容器的文件系统。

1、修改 Deployment 时，容器内的任何进程都不能修改本地文件系统，只有 directory /tmp应该是可写的。不要修改 Docker 镜像。
将更新的 YAML 保存在cks7262下/opt/course/19/immutable-deployment-new.yaml 并更新正在运行的 Deployment。

二、问题解决过程

1.问题一解题

过程如下（示例）：

#按要求连接对应的集群
candidate@terminal:~$ ssh cks7262

#切换到root用户下，防止普通用户操作写入文件没权限
candidate@cks7262:~$  sudo -i

#修改 immutable-deployment文件
root@cks7262:~# cp /opt/course/19/immutable-deployment.yaml /opt/course/19/immutable-deployment-new.yaml
root@cks7262:~# vim /opt/course/19/immutable-deployment-new.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: team-purple
  name: immutable-deployment
  labels:
    app: immutable-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: immutable-deployment
  template:
    metadata:
      labels:
        app: immutable-deployment
    spec:
      containers:
      - image: busybox:1.32.0
        command: ['sh', '-c', 'tail -f /dev/null']
        imagePullPolicy: IfNotPresent
        name: busybox
        securityContext:                  # add
          readOnlyRootFilesystem: true    # add
        volumeMounts:                     # add
        - mountPath: /tmp                 # add
          name: temp-vol                  # add
      volumes:                            # add
      - name: temp-vol                    # add
        emptyDir: {}                      # add
      restartPolicy: Always

#更新deployment
root@cks7262:~# kubectl delete -f /opt/course/19/immutable-deployment.yaml
deployment.apps "immutable-deployment" deleted

root@cks7262:~# kubectl create -f /opt/course/19/immutable-deployment-new.yaml
deployment.apps/immutable-deployment created

---