CKS Challenege 2 - startupProbe to remove shells

Kubernetes
#1

Hi!
I’m not sure how to resolve this step from the second contest in this challenge, inside the dev pod.

This pod can be accessed using the ‘kubectl exec’ command. We want to make sure that this does not happen. Use a startupProbe to remove all shells before the container startup. Use ‘initialDelaySeconds’ and ‘periodSeconds’ of ‘5’. Hint: For this to work you would have to run the container as root!

I don’t get the sense of using a startupProbe to remove something actually, but I’ve still tried something ugly like the following, which didn’t work.
Suggestions?

spec:
  containers:
    ...
    startupProbe:
      "remove the shells"
      initialDelaySeconds: 5
      periodSeconds: 5

Thanks

1 Like
#2

It’s a challenge for rewards so I won’t share much details but there is one more shell that will provide you access to the pod’s container.

Regards,
KodeKloud Support

2 Likes
#3

Thanks,
actually the answer is written in the box for the staging pod :smiley:

I didn’t know about the prizes sorry, I’m removing part of the question :slight_smile:

#4

Please check out this post for more information.
Certified Kubernetes Security Specialist Challenge Series

1 Like
#5

I’m stuck in this task for the last two days… I don’t know how to move forward

#6

I’ve finally removed the shells and I can’t access to the pod using kubexec, but still is not ok

root@controlplane ~ ✖ k exec -it dev-webapp -n dev sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
OCI runtime exec failed: exec failed: container_linux.go:367: starting container process caused: exec: "sh": executable file not found in $PATH: unknown
command terminated with exit code 126

root@controlplane ~ ✖ k exec -it dev-webapp -n dev ash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
OCI runtime exec failed: exec failed: container_linux.go:367: starting container process caused: exec: "ash": executable file not found in $PATH: unknown
command terminated with exit code 126

root@controlplane ~ ✖
#7

Hi @Javier3 ,
Can you please share more context? what do you mean by “still is not ok”?
You are not getting a green tick mark on that given description after removing the shell and specifying the mentioned fields on the pod?

Regards,
KodeKloud Support

#8

Yes, that’s it. The shells are not available in the pod. I can’t access, executing kubectl exec… and still I don’t have the green check. I can share with you what I did…

1 Like
#9

I don’t know if it’s checking the file /etc/passwd or if the ash & sh are not available, both… honestly I don’t know.

#10

@Javier3 try kubectl -n dev exec -it dev-webapp sh

1 Like
#11

@Ayman I did it too

root@controlplane ~ :heavy_multiplication_x: k exec -it dev-webapp -n dev sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] – [COMMAND] instead.
OCI runtime exec failed: exec failed: container_linux.go:367: starting container process caused: exec: “sh”: executable file not found in $PATH: unknown
command terminated with exit code 126

1 Like
#12

Kindly check the attached gif
exec

Certified Kubernetes Security Specialist Challenge Series
#13

I don’t get a green klick althought i have prevent the exec to run with a startup probe:
kubectl exec --stdin --tty -n staging staging-webapp – ash
OCI runtime exec failed: exec failed: container_linux.go:367: starting container process caused: exec: “ash”: executable file not found in $PATH: unknown
command terminated with exit code 126

2 Likes
#14

Of course, it works before modifying the pod. After disabling the shells, you can not access.

#15

Same here, I don’t know what they are checking.

1 Like
#16

Hi @fonguetaghuo ,
Can you please share the screenshot? and DM me your manifest file.

Regards,

#17

Hi @Javier3 ,
Can you please DM me your manifest file? So you are having an issue only with this question?

Regards,

#18

Hello, @Tej-Singh-Rana I can’t send it, I don’t know how. I can’t find the message button in your avatar.

EDIT: I’ve already sent it

Thanks for your help

#19

Hi @Javier3 ; is the issue is solved; iam also facing the same issue

#20

I have removed all command in /bin of the pod. No exec commands work on it after that but still the check fails :sweat_smile: :joy: