This document is the property of Al Nafi.
Any unauthorized redistribution or reproduction, including in printed form, is strictly
prohibited. This document can only be read electronically.
Lab 1: Ensuring Security and Compliance
Lab Name: Ensuring Security and Compliance
Objectives:
td
● Understand security contexts and roles.
tl
● Implement security best practices for applications.
● Use OpenShift's security features to ensure cluster and application compliance.
Pv
Task 1: Set up and Manage Security Contexts for Pods
ng
Objective:
Set up and manage security contexts for pods.
ni
ar
Explanation:
Le
Security contexts define the operating system-level security settings for a pod or
container. Properly configuring them enhances the security posture of applications.
Coding Example:
IE
# Example Pod definition with securityContext
AF
apiVersion: v1
kind: Pod
metadata:
N
name: mypod
spec:
containers:
AL
- name: mycontainer
image: myimage
securityContext:
runAsUser: 1000
capabilities:
add: ["NET_ADMIN"]
Task 2: Define Roles and Role Bindings for Fine-Grained
Access Control
Objective:
Define roles and role bindings for fine-grained access control.
td
Explanation:
Roles and role bindings in OpenShift enable granular access control, ensuring that users
tl
or entities have the minimum necessary permissions.
Pv
Coding Example:
ng
# Example Role definition
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
ni
metadata:
namespace: mynamespace
ar
name: pod-reader
rules:
Le
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
IE
# Example RoleBinding definition
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
AF
name: read-pods
namespace: mynamespace
subjects:
N
- kind: User
name: "john"
apiGroup: rbac.authorization.k8s.io
AL
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Task 3: Audit a Cluster for Compliance with Security Standards
Objective:
Audit a cluster for compliance with security standards.
Explanation:
Periodic audits help ensure that the cluster adheres to security standards and policies,
providing insights into potential vulnerabilities.
td
Coding Example:
tl
# Example command to perform a security audit
Pv
oc adm audit --path=audit.log
Conclusion:
ng
This lab ensures participants are proficient in securing OpenShift clusters and
ni
applications. By setting up security contexts, defining roles, role bindings, and
conducting security audits, participants acquire the skills necessary to establish and
ar
maintain a robust security posture in a production-grade OpenShift environment.
Le
IE
AF
N
AL
