Secure Workloads in Google Kubernetes Engine: Challenge Lab [GSP335]

GSP335 : Secure Workloads in Google Kubernetes Engine: Challenge Lab :-

----------------------------------------------------------------------------------------------------------------------------------------------

gsutil -m cp gs://cloud-training/gsp335/* .

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 1 : Create kubernetes cluster :-

gcloud container clusters create kraken-cluster \
   --zone us-central1-c \
   --machine-type n1-standard-4 \
   --num-nodes 2 \
   --enable-network-policy

gcloud container clusters get-credentials kraken-cluster  --zone us-central1-c

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 2 : Create Cloud SQL instance :-

gcloud sql instances create kraken-cloud-sql --region us-central1

gcloud sql databases create wordpress --instance kraken-cloud-sql --charset utf8 --collation utf8_general_ci

gcloud sql users create wordpress --host % --instance kraken-cloud-sql --password Passw0rd

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 3 : Create a service account :-

gcloud iam service-accounts create kraken-wordpress-sa

gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
   --member="serviceAccount:kraken-wordpress-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com" \
   --role="roles/cloudsql.client"

gcloud iam service-accounts keys create key.json --iam-account=kraken-wordpress-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com

kubectl create secret generic cloudsql-instance-credentials --from-file key.json

kubectl create secret generic cloudsql-db-credentials \
   --from-literal username=wordpress \
   --from-literal password='Passw0rd'

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 4 : Create the WordPress deployment and service :-

kubectl create -f volume.yaml

// Go to the overview page of your Cloud SQL instance, and copy the Connection name.

// Open wordpress.yaml with your any editor, and replace INSTANCE_CONNECTION_NAME (in line 61) 
   with the Connection name of your Cloud SQL instance and Save the file changes.
   
kubectl apply -f wordpress.yaml

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 5 : Setup Ingress with TLS :-

helm version

helm repo add stable https://charts.helm.sh/stable
helm repo update

// If your environment does not install with Helm :-
   curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
   chmod 700 get_helm.sh
   ./get_helm.sh

helm install nginx-ingress stable/nginx-ingress --set rbac.create=true

kubectl get service nginx-ingress-controller -w

. add_ip.sh

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.2.0/cert-manager.yaml

kubectl create clusterrolebinding cluster-admin-binding \
   --clusterrole=cluster-admin \
   --user=$(gcloud config get-value core/account)
   
// Edit issuer.yaml and set the email address
   Save the file changes and run :-

kubectl apply -f issuer.yaml

// Edit ingress.yaml and set your YOUR_LAB_USERNAME.labdns.xyz DNS record to lines 11 and 14.

// Save the file changes and run :-

kubectl apply -f ingress.yaml

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 6 : Setup Network Policy :-

nano network-policy.yaml

// Set the values of name and spec as shown below :-
  
   apiVersion: Networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
      name: allow-world-to-nginx-ingress
      namespace: default
   spec:
      podSelector:
         matchLabels:
         app: nginx-ingress
      policyTypes:
      - Ingress
      ingress:
      - {}

// save the file by ctrl + x -> y -> enter

kubectl apply -f network-policy.yaml

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 7 : Setup Binary Authorization :-

// Goto Cloud Console -> Security -> Binary Authorization.
// Enable the Binary Authorization API.
// On Binary Authorization page, click CONFIGURE POLICY.
// Select Disallow all images for the Default rule.

// Scroll down to Images exempt from this policy, click ADD IMAGE PATH and paste :-
   -> docker.io/library/wordpress:latest

// Repeat the above two steps to add the following image paths :-
   -> us.gcr.io/k8s-artifacts-prod/ingress-nginx/*
   -> gcr.io/cloudsql-docker/*
   -> quay.io/jetstack/*

// Click SAVE POLICY.

// Navigate to Kubernetes Engine -> Clusters.

// Click your cluster name to view its detail page.

// Edit Binary authorization and Enable Binary Authorization then SAVE CHANGES.

----------------------------------------------------------------------------------------------------------------------------------------------

Task - 8 : Setup Pod Security Policy :-

kubectl apply -f psp-role.yaml
kubectl apply -f pop-use.yaml

nano psp-restrictive.yaml

// replace appVersion: extensions/v1beta1 with policy/v1beta1

// Save the changes.

kubectl apply