Section 7: Security (10-14)

To manage and view certificate details in a cluster we need to know ____________________

• How the cluster was set up

• What are the CA files

• What are the private and public key

• What are the CA tokens

What's true when we deploy a Kubernetes Cluster from scratch?

• The CA files are no longer needed

• Kubeadm automatically generates the key and certificate files

• We generate all certificates by ourselves

• We generate an extra CA token

What's true when we deploy a Kubernetes Cluster using Kubeadm?

• The CA files are no longer needed

• Kubeadm automatically generates the key and certificate files

• We generate all certificates by ourselves

• We generate an extra CA token

How do we get a list of certificates files used in a Kubernetes Cluster?

• Checking the Kubelet definition file

• Checking the kube-apiserver definition file

• Running: kubectl get certificates

• Running: kubectl get cert-files

• Checking the ETCD Server

Run the full command to decode and get information about the apiserver.crt file located in: /etc/kubernetes/pki/apiserver.crt

When you run the command openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

What field show information about the name of the certificate?

• Issuer

• Subject Alternative Name

• Subject

• Validity

When you run the command openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

What field show the alternate names of the certificate?

• Issuer

• Subject Alternative Name

• Subject

• Validity

When you run the command openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

What field show the expiry date?

• Issuer

• Subject Alternative Name

• Subject

• Validity

When you run the command openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

What field verify the certificate was issued by the CA?

• Issuer

• Subject Alternative Name

• Subject

• Validity

Type the full command to check the etcd.service logs only, without truncate the logs in the output, in case the Kubernetes cluster was deployed from scratch.