DevOps Tools, CI/CD and Automation Guides - Page 12

Scan container images with Trivy, filter vulnerabilities by severity, enforce CI exit codes, manage ignores, export reports, and verify rebuilt images.

Compare Kubernetes multi-tenancy models and validate namespace isolation with RBAC, NetworkPolicy, Pod Security, quotas, nodes, and clusters.

Audit and harden kubeadm Linux nodes by reducing services, securing SSH and Kubernetes files, mapping firewall paths, patching safely, and validating readiness.

Apply Kubernetes seccompProfile types Unconfined, RuntimeDefault, and Localhost on Pods and containers, install a custom profile on the kubelet seccomp path, and diagnose denied syscalls with logs and exit codes.

Audit the kube-apiserver static Pod manifest on a kubeadm control plane, review TLS, anonymous access, authorization, admission, and ServiceAccount issuer settings, apply one hardening change safely, and validate health …

Install gVisor runsc on a Kubernetes worker, register a containerd runtime handler, create a RuntimeClass with scheduling constraints, and compare sandboxed Pods against default runc workloads.

Configure Kubernetes Pod Security Admission with namespace labels for enforce, audit, and warn modes, remediate noncompliant workloads, pin policy versions, and migrate from removed PodSecurityPolicy.

Apply Kubernetes appArmorProfile types RuntimeDefault, Localhost, and Unconfined on Pods and containers, load a custom AppArmor profile on worker nodes, and diagnose allowed and denied file access from kubelet events and …

Download official Kubernetes release artifacts, verify SHA256 checksums and Cosign signatures on kubectl binaries and SPDX SBOMs, validate signed control-plane images, and record digests before install or deployment.

Audit kubelet authentication and authorization, test nodes/proxy and direct kubelet access, restrict cloud metadata exposure from Pods, and validate monitoring paths on a kubeadm cluster.

Audit a kubeadm cluster with kube-bench, interpret CIS PASS, WARN, and FAIL results, map findings to files, remediate one check, and verify the fix.

Map Kubernetes security architecture across the API server, nodes, workloads, networks, and supply chain, with attack paths and controls for CKS study.

Route HTTP and HTTPS traffic with Kubernetes Gateway API using GatewayClass, Gateway, and HTTPRoute for path matching, hostnames, weighted backends, TLS, and ReferenceGrant.

Troubleshoot Kubernetes PVC Pending, WaitForFirstConsumer delays, FailedAttachVolume, Multi-Attach, and FailedMount by following the volume lifecycle and reading Events.

Create a kubelet static Pod from a local manifest, inspect it with crictl, watch the API mirror Pod, and relate the same pattern to kubeadm control-plane components.

Protect replicated workloads with a PodDisruptionBudget, compare minAvailable and maxUnavailable, inspect disruptions allowed, and test voluntary eviction behavior with kubectl drain.

Upgrade a kubeadm cluster one minor version at a time: back up etcd, switch pkgs.k8s.io repositories, upgrade the control plane, then run kubeadm upgrade node, drain, and upgrade kubelet on each worker.

Control Pod placement with nodeSelector, required and preferred node affinity, IgnoredDuringExecution behavior, and pod affinity or anti-affinity using topologyKey on a kubeadm lab.

Configure Kubernetes HPA with Metrics Server, scale a Deployment by CPU and memory, and observe scale-up, scale-down, and autoscaling/v2 behavior.

Add, drain, remove, reset and rejoin kubeadm worker nodes with fresh tokens, version-skew checks, CSR verification and Ready-state testing.

Back up kubeadm-managed etcd with etcdctl, verify and restore the snapshot with etcdutl, and confirm Kubernetes API objects return.

Inspect kubeadm PKI under /etc/kubernetes/pki, create a client identity with a CertificateSigningRequest, build a kubeconfig, and renew control-plane certificates with kubeadm certs renew.

Compare Kubernetes CNI, CSI, and CRI extension interfaces, see how kubelet delegates networking, storage, and container execution, and run kubectl and node commands to discover what your cluster actually uses.

Fix Kubernetes Node NotReady and Unknown status by inspecting Node conditions, Lease heartbeats, kubelet and containerd, resource pressure, certificates, and kubectl debug node.

Troubleshoot a kubeadm control plane by branching on API reachability, then repairing static Pod manifests, kube-apiserver, etcd, scheduler, and controller-manager.

Troubleshoot FailedCreatePodSandBox and CNI errors by reading Events, scoping the failure, checking CNI agents and node config, and verifying sandbox networking with crictl.

Explain the Kubernetes networking model across same-Pod, Pod-to-Pod, and Pod-to-Service paths, including CNI, Pod and Service CIDRs, kube-proxy modes, and EndpointSlices.

Define a StorageClass, watch a PVC trigger dynamic PV creation with WaitForFirstConsumer, set a default class, compare reclaim policies, and verify mounts with the Rancher local-path provisioner.

Install a multi-node Kubernetes cluster with kubeadm, containerd, and Calico on Linux, with commands for RHEL-family, Ubuntu, and Debian systems.

Scan-first CKAD command reference for kubectl dry-run YAML generation, apply and patch, JSONPath, rollouts, Helm, Kustomize, probes, and troubleshooting with links to course lessons.