0e5f7686ee
Add lessons: untimed guided labs, one per curriculum objective, on a host of their own, in the browser and in the terminal. Each step has a check, a hint and its commands; a lesson writes no history or scores, only a done mark on its objective. CKAD 2.1-2.4 (24 steps) and all 27 CKA objectives (135 steps) have one, and `./ksim lesson audit` proves that every step fails, is done by its own commands, then passes. Add CKA tasks 132-147 (cka/bank_course.py) on what a full CKA course teaches beyond the bank: a real upgrade from v1.36, a drain under a PodDisruptionBudget, QoS and eviction, in-place resize, kube-proxy's chains, encryption at rest, an operator, and CSI expansion, snapshots and clones (ensure_csi_hostpath). Move CKA and CKS to Kubernetes v1.37 and rebuild the hosts on Ubuntu 24.04, with kubelet, kubeadm and kubectl as held packages from pkgs.k8s.io; the desktop runs Ubuntu too. Hosts gain man pages, hexdump and xxd. Fix CKS Q4, which gave 3 of 12 points untouched, and CKA Q4 and Q49, whose solutions raced their new CRD. Audited on v1.37: CKA 147/147, CKAD 105/105, CKS 109/110 (Q103, a Falco task, failed to seed once and awaits a re-audit); lessons: 135 of 135 CKA steps and 24 of 24 CKAD steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
2.9 KiB
Docker
43 lines
2.9 KiB
Docker
# CKS exam host: the common exam host (images/node) plus what the CKS hosts carry - the scanners,
|
|
# a sandbox runtime and a service mesh client. Built by `./ksim build cks`.
|
|
ARG BASE
|
|
FROM ${BASE}
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
python3-minimal binutils strace file bzip2 conntrack tcpdump lsof kmod vsftpd \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
# vsftpd is here to be found and removed in a task; it must not run on every host
|
|
&& (systemctl disable vsftpd >/dev/null 2>&1 || true) \
|
|
&& rm -f /etc/systemd/system/multi-user.target.wants/vsftpd.service
|
|
|
|
# --- CKS tools --------------------------------------------------------------------------------
|
|
ARG KUBE_BENCH=0.16.0
|
|
ARG TRIVY=0.75.0
|
|
ARG KUBESEC=2.15.0
|
|
ARG KUBE_LINTER=0.8.3
|
|
ARG BOM=0.8.0
|
|
ARG COSIGN=3.1.3
|
|
ARG ISTIO=1.31.1
|
|
ARG GVISOR=20261005
|
|
RUN cd /tmp && G=https://github.com \
|
|
&& curl -fsSL "$G/aquasecurity/kube-bench/releases/download/v${KUBE_BENCH}/kube-bench_${KUBE_BENCH}_linux_amd64.tar.gz" | tar -xz kube-bench cfg \
|
|
&& install -m755 kube-bench /usr/local/bin/ && mkdir -p /etc/kube-bench && rm -rf /etc/kube-bench/cfg && mv cfg /etc/kube-bench/cfg && rm -f kube-bench \
|
|
&& curl -fsSL "$G/aquasecurity/trivy/releases/download/v${TRIVY}/trivy_${TRIVY}_Linux-64bit.tar.gz" | tar -xz -C /usr/local/bin trivy \
|
|
&& curl -fsSL "$G/controlplaneio/kubesec/releases/download/v${KUBESEC}/kubesec_linux_amd64.tar.gz" | tar -xz -C /usr/local/bin kubesec \
|
|
&& curl -fsSL "$G/stackrox/kube-linter/releases/download/v${KUBE_LINTER}/kube-linter-linux.tar.gz" | tar -xz -C /usr/local/bin kube-linter \
|
|
&& curl -fsSL -o /usr/local/bin/bom "$G/kubernetes-sigs/bom/releases/download/v${BOM}/bom-amd64-linux" \
|
|
&& curl -fsSL -o /usr/local/bin/cosign "$G/sigstore/cosign/releases/download/v${COSIGN}/cosign-linux-amd64" \
|
|
&& curl -fsSL "$G/istio/istio/releases/download/${ISTIO}/istioctl-${ISTIO}-linux-amd64.tar.gz" | tar -xz -C /usr/local/bin istioctl \
|
|
&& curl -fsSL "https://storage.googleapis.com/gvisor/releases/release/${GVISOR}/x86_64/gvisor.tar.bz2" | tar -xj -C /usr/local/bin \
|
|
&& chmod 755 /usr/local/bin/* \
|
|
&& chown -R root:root /usr/local/bin /etc/kube-bench
|
|
|
|
COPY rootfs/ /
|
|
# gVisor as a second runtime handler ("runsc") beside runc; a RuntimeClass selects it
|
|
RUN printf '\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]\n runtime_type = "io.containerd.runsc.v1"\n [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc.options]\n TypeUrl = "io.containerd.runsc.v1.options"\n ConfigPath = "/etc/containerd/runsc.toml"\n' >> /etc/containerd/config.toml \
|
|
# trivy reads /etc/trivy.yaml (the Docker Hub cache as a mirror, one cache directory for all
|
|
# users), for logins and for sudo alike
|
|
&& install -d -m 1777 /var/lib/trivy \
|
|
&& echo 'TRIVY_CONFIG=/etc/trivy.yaml' >> /etc/environment \
|
|
&& echo 'export TRIVY_CONFIG=/etc/trivy.yaml' >> /etc/exam.bashrc
|