Introduction#
this section show
- question 10 ConfigMap
- question 11 Secret
- question 12 Security Context
- question 13 Resource Quota
- Question 14 Service Account
- Question 11b Secret
Question 10 ConfigMap#
- create a new file named config.txt with environment varialbes as key/value pairs
- DB_URL=localhost:1443, DB_USERNAME=postgres
- create a new configmap named db-config
- create a pod named sqlsrv that uses that environment varialbes from the configmap and runs a container using image of nginx
- shell into the pod and display the created environment varialbes
create configmap
kubectl create configmap db-config --from-env-file=config.txt
double check
kubectl get configmap db-config
describe the configmap
kubectl describe configmap db-config
create a pod
kubectl create sqlsrv --image=nginx --dry-run=client --output=yaml > q2.yaml
edit to load environment varialbes from configmap
apiVersion: v1kind: Podmetadata:creationTimestamp: nulllabels:run: sqlsrvname: sqlsrvspec:containers:- image: nginxname: sqlsrvresources: {}envFrom:- configMapRef:name: db-configdnsPolicy: ClusterFirstrestartPolicy: Alwaysstatus: {}
create the pod
kubectl create -f q2.yaml
shell into the pod and echo environment varialbes
kubectl exec sqlsrv -it -- /bin/sh
echo the environment varialbes
echo $DB_URLecho $DB_USERNAME
another option
kubectl exec sqlsrv -it -- env
delete the sqlsrv pod
kubectl delete -f q2.yaml
delete the config map
kubectl delete configmap db-config
Question 11 Secret#
- create a secrete from literal values
- create a secrete named db-credentials with key/value pair db-password=speed
- create a pod named sqlsrv that uses the secrete as environment variable named DB_PASSWORD and run the container with the image nginx
- shell into the pod and print out the created environment variables
create a secrete from literal
kubectl create secret generic db-crendetials --from-literal=db_password=speed
double check
kubectl get secret db-crendetials
create a pod
kubectl run sqlsrv --image=nginx --dry-run=client --output=yaml > q3.yaml
create the DB_PASSWORD environment and refer to the secret variables
apiVersion: v1kind: Podmetadata:creationTimestamp: nulllabels:run: sqlsrvname: sqlsrvspec:containers:- image: nginxname: sqlsrvenv:- name: DB_PASSWORDvalueFrom:secretKeyRef:name: db-credentialskey: db_passwordresources: {}dnsPolicy: ClusterFirstrestartPolicy: Alwaysstatus: {}
double check
kubectl get pods
shell into the pod
kubectl exec sqlsrv -it -- /bin/sh
and echo the DB_PASSWORD
echo $DB_PASSWORD
delete pods
kubectl delete -f q3.yaml
delete credentials the secret in kubectl
kubectl delete secret db-credentials
Question 12 Security Context#
- create a pod named secured that uses the image nginx
- mount an emptyDir volume to the directory /data/app
- files created on the volume should use the filesystem group ID 3000
- shell to the running container and create new file named logs.txt in the directory/data/dapp
- list the contents of the directory and write them down
create a pod
kubectl run secured --image=nginx --dry-run=client --output=yaml > q4.yaml
edit the yaml
apiVersion: v1kind: Podmetadata:creationTimestamp: nulllabels:run: securedname: securedspec:securityContext:fsGroup: 3000containers:- image: nginxname: securedresources: {}volumeMounts:- name: data-volmountPath: /data/appvolumes:- name: data-volemptyDir: {}dnsPolicy: ClusterFirstrestartPolicy: Alwaysstatus: {}
then shell into the pod
kubectl exec secured -it -- /bin/sh
create data in /data/app
cd /data/app
create a file and check
touch logs.txt
check
ls -l logs.txt
delete the pod
kubectl delete -f q4.yaml
Question 13 Resource Quota#
- create a resource quota named app under the namespace rq-demo
- use the file named rq.yaml
- create a new pod the exceeds the limits of the resource quota be defining 1G of memory
- note the error
- change the requests limit to fulfill the requirements to ensure that the pod can be created successfully
create a namespace rq-demo
kubectl create namespace rq-demo
create resource quota
kubectl create quota app --hard=cpu=1,memory=500m,pods=2 --namespace=rq-demo --dry-run=client --output=yaml > rq5.yaml
apply
kubectl create -f rq5.yaml
double check
kubectl get quota rq-demo --namespace=rq-demo
create a pod which exceeds the quota
kubectl run highpod --image=nginx --dry-run=client --output=yaml > q5.yaml
then edit the q5.yaml with resource requests and limit (optional)
apiVersion: v1kind: Podmetadata:creationTimestamp: nulllabels:run: highpodname: highpodnamespace: rq-demospec:containers:- image: nginxname: highpodresources:requests:memory: '256m'cpu: '1'dnsPolicy: ClusterFirstrestartPolicy: Alwaysstatus: {}
create and get error due to exceeds the quota
kubectl create -f q5.yaml --namespace=app
lowever the request in q5.yaml and create the pod again
Question 14 Service Account#
- create a new service account named backend-team
- print out the token for the service account in YAML format
- create a pod named backend that uses the image nginx and the identity backend-team for running processes
- shell to the running container and print out the token of the service account
create a service account
kubectl create serviceaccount backend-team
double check
kubectl get serviceaccount
print out token of the serviceaccount
kubectl get serviceaccount --output=yaml
create a pod named backend that uses the image nginx and the identity backend-team for running processes
kubectl run backend --image=nginx --dry-run=client --output=yaml
then update the yaml file
apiVersion: v1kind: Podmetadata:creationTimestamp: nulllabels:run: backendname: backendspec:serviceAccountName: backend-teamcontainers:- image: nginxname: backendresources: {}dnsPolicy: ClusterFirstrestartPolicy: Alwaysstatus: {}
apply
kubectl create -f q6.yaml
shell into and check
kubectl exec backend -it -- /bin/sh
find the token
cd var/run/secrets/kubernetes.io/serviceaccount
and cat the token
cat token
Question 11b Secret#
- create a deployment with the name secret service
- use image of alpine
- create a secret which uses two variables username=trixie and password=mach5
- these variables must be added as a volume in the pod
- these variables must be added as a volume in the pod
create a deployment yaml
kubectl create deployment secretservice --image=alpine --dry-run=client --output=yaml > q10.yaml
create a secret with two variables
kubectl create secret generic my-secret --from-literal=username=trixie --from-literal=password=mach5
double check
kubectl get secret
describe secret
kubectl describe secret my-secret
update the deployment yaml file
apiVersion: apps/v1kind: Deploymentmetadata:creationTimestamp: nulllabels:app: secretservicename: secretservicespec:replicas: 1selector:matchLabels:app: secretservicestrategy: {}template:metadata:creationTimestamp: nulllabels:app: secretservicespec:containers:- image: alpinename: alpinecommand: ['sleep', '10000']volumeMounts:- name: secret-volmountPath: '/etc/users'resources: {}volumes:- name: secret-volsecret:secretName: my-secretstatus: {}
deploy or apply
kubectl create -f q10.yaml
then double check
kubectl describe deployment secretservice
or shell into the pod
kubectl exec PODNAME -it -- /bin/sh
then find the secret variables in
cd /etc/users
should see password and username here