Challenges | iximiuz Labs

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Lock Down Container Syscalls With Seccomp Profiles

by Omkar Shelke

Run a Deployment under the container runtime's seccomp profile, roll out a custom profile to the worker nodes, and fix a profile that blocks a syscall the application needs.

#cks #seccomp #securitycontext #syscalls

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Roll Out Pod Security Standards Across Three Namespaces

by Omkar Shelke

The platform team is rolling out Pod Security Admission. A monitoring agent is already blocked, the storefront team needs a staged rollout, and payments must move to the strictest level without losing its running service.

#cks #pod-security #psa #securitycontext

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Networking, Security

Pick and Deploy the Least Permissive NetworkPolicy

by Omkar Shelke

The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.

#cka #ckad #cks #network-policy

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Disable API Server NodePort and Configure kube-scheduler Resource Requests

by Omkar Shelke

Configure the kube-scheduler static pod with CPU resource requests based on node allocatable, and disable the NodePort access to the Kubernetes API server so it is only reachable via ClusterIP.

#cks #cka #kube-scheduler #api-server

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Troubleshoot CrashLoopBackOff Caused by a Missing TLS Secret

by Omkar Shelke

A deployment is failing because the application cannot load its TLS certificate. Create the missing secret and mount it into the deployment so the Flask app can serve TLS traffic.

#cka #cks #tls #secrets #troubleshooting

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Verify Kernel Isolation Between Kata Containers and runc Using RuntimeClass

by Omkar Shelke

Prove that Kata Containers Pods run inside a dedicated VM with a separate guest kernel, completely isolated from the host kernel, by comparing kernel versions across runc and Kata runtimes.

#cks #runtimeclass #kata-containers #sandbox #isolation

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Schedule a Maintenance Pod with Host Namespace Access Using Taints, Tolerations, and NodeSelector

by Omkar Shelke

Learn how to taint a node, schedule a Pod using nodeSelector and tolerations, and share the host network, PID, and IPC namespaces with the Pod.

#cka #cks #scheduling #taints #tolerations

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security, Networking

Control Cross-Namespace Traffic Using NetworkPolicy

by Omkar Shelke

A multi-tier application runs across two namespaces. Learn how to isolate the application tier and restrict database access to only the application namespace.

#ckad #cka #cks #network-policy