Secure-Workloads-in-Google-Kubernetes-Engine-Challenge-Lab Challenge lab level 1

Secure-Workloads-in-Google-Kubernetes-Engine-Challenge-Lab.txt

gcloud container clusters create security-demo-cluster295 \
   --zone us-central1-c \
   --machine-type n1-standard-4 \
   --num-nodes 2 \
   --enable-network-policy

gcloud sql instances create wordpress-db-676 --region us-central1

gcloud iam service-accounts create sa-wordpress-119

gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
   --member="serviceAccount:sa-wordpress-119@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com" \
   --role="roles/cloudsql.client"

gcloud iam service-accounts keys create key.json --iam-account=sa-wordpress-119@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com

kubectl create secret generic cloudsql-instance-credentials --from-file key.json

kubectl create secret generic cloudsql-db-credentials \
   --from-literal username=wordpress \
   --from-literal password=''

helm version

helm repo add stable https://charts.helm.sh/stable
helm repo update

helm install nginx-ingress stable/nginx-ingress --set rbac.create=true

kubectl get service

. add_ip.sh  

kubectl apply -f https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbVVzSXgybFVKekNkVlhPWXplSUhNTHI2bl9Sd3xBQ3Jtc0ttS2VVUkRVektWMWdXVG5jZlBxZURRaEcxeGRpVVo3b2xSTjFQV21CMmFRUWVjZkNkZ2FuVmhTX2twSmxJc3hlU3JJOUlxcTNtellGZmZnemNpOXh1eTV5R2J2ZkMzRk1KYXdMNE5XZkZuQkU5OHE1UQ&q=https%3A%2F%2Fgithub.com%2Fjetstack%2Fcert-manager%2Freleases%2Fdownload%2Fv1.2.0%2Fcert-manager.yaml

kubectl create clusterrolebinding cluster-admin-binding \
   --clusterrole=cluster-admin \
   --user=$(gcloud config get-value core/account)

kubectl apply -f issuer.yaml

kubectl apply -f ingress.yaml

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-world-to-nginx-ingress
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: nginx-ingress
  policyTypes:
  - Ingress
  ingress:
  - {}

kubectl apply -f network-policy.yaml

goto security - Binary authorisatioin
- configure policy 
- disallow all images
- create specific rules, select cluster
- add specific rule, type us and select from dropdown, click add
- custom expetion path 
- add iamge paths given 
- save policy 
enanble binary authorisation for kuberetes clusater

edit psp-restrictive.yaml 
line 2 change extensions/v1beta1 to policy/v1beta1
kubectl apply -f psp-restrictive.yaml
kubectl apply -f psp-role.yaml
kubectl apply -f psp-use.yaml