From 41c4b277aa086b9f4cbfd5dd1ab9dd89c3510008 Mon Sep 17 00:00:00 2001 From: Nishan Date: Sat, 5 Apr 2025 15:20:55 +0530 Subject: [PATCH] Refactor Labs --- LICENSE | 21 + README.md | 20 +- app/public/index.html | 16 +- app/public/js/results.js | 4 +- compose.yaml => docker-compose.yaml | 0 docs/CONTRIBUTING.md | 2 +- .../TERMS_OF_SERVICE.md | 0 docs/how-to-add-new-labs.md | 10 +- docs/local-setup-guide.md | 6 +- facilitator/assets/exams/cka/001/answers.md | 343 ++++++++++ .../assets/exams/cka/001/assessment.json | 255 +++++++ facilitator/assets/exams/cka/001/config.json | 10 + .../exams/cka/001/scripts/setup/q10_setup.sh | 28 + .../exams/cka/001/scripts/setup/q1_setup.sh | 8 + .../exams/cka/001/scripts/setup/q2_setup.sh | 10 + .../exams/cka/001/scripts/setup/q3_setup.sh | 11 + .../exams/cka/001/scripts/setup/q4_setup.sh | 21 + .../exams/cka/001/scripts/setup/q5_setup.sh | 12 + .../exams/cka/001/scripts/setup/q6_setup.sh | 14 + .../exams/cka/001/scripts/setup/q7_setup.sh | 13 + .../exams/cka/001/scripts/setup/q8_setup.sh | 15 + .../exams/cka/001/scripts/setup/q9_setup.sh | 13 + .../scripts/validation/q10_s1_validate_pod.sh | 70 ++ ..._s2_validate_health_check_effectiveness.sh | 88 +++ .../validation/q1_s1_validate_namespace.sh | 12 + .../scripts/validation/q1_s2_validate_pod.sh | 29 + .../validation/q1_s3_validate_pod_status.sh | 36 + .../validation/q2_s1_validate_static_pod.sh | 32 + .../q2_s2_validate_static_pod_config.sh | 43 ++ .../validation/q3_s1_validate_storageclass.sh | 21 + .../scripts/validation/q3_s2_validate_pvc.sh | 30 + .../q3_s3_validate_storage_access.sh | 44 ++ .../scripts/validation/q4_s1_validate_pod.sh | 52 ++ .../validation/q4_s2_validate_logging.sh | 43 ++ .../scripts/validation/q5_s1_validate_sa.sh | 14 + .../scripts/validation/q5_s2_validate_rbac.sh | 50 ++ .../q5_s3_validate_rbac_permissions.sh | 43 ++ .../q6_s1_validate_networkpolicy.sh | 37 + .../q6_s2_validate_network_policy_effect.sh | 42 ++ .../validation/q7_s1_validate_deployment.sh | 36 + .../validation/q7_s2_validate_service.sh | 44 ++ .../scripts/validation/q8_s1_validate_pod.sh | 61 ++ .../q8_s2_validate_resource_usage.sh | 73 ++ .../validation/q9_s1_validate_configmap.sh | 28 + .../scripts/validation/q9_s2_validate_pod.sh | 43 ++ .../q9_s3_validate_configmap_usage.sh | 60 ++ facilitator/assets/exams/ckad/001/answers.md | 338 ++++++---- .../assets/exams/ckad/001/assessment.json | 36 +- .../exams/ckad/001/scripts/setup/q7_setup.sh | 2 +- .../validation/q10_s2_validate_pod_running.sh | 16 + .../q10_s3_validate_pod_env_vars.sh | 30 + .../q11_s3_validate_cronjob_command.sh | 23 + .../q11_s4_validate_cronjob_policy.sh | 28 + .../q13_s2_validate_clusterrolebinding.sh | 34 +- .../q16_s2_validate_pod_selector.sh | 29 + .../q16_s3_validate_policy_rules.sh | 39 ++ .../q17_s2_validate_service_selector.sh | 27 + .../q17_s3_validate_service_ports.sh | 41 ++ .../q19_s3_validate_ingress_backend.sh | 98 +-- .../validation/q20_s1_validate_job_created.sh | 14 + .../validation/q20_s2_validate_job_config.sh | 11 +- .../q20_s3_validate_job_completed.sh | 56 ++ ...3_s3_validate_storageclass_binding_mode.sh | 2 +- .../q4_s3_validate_pvc_access_mode.sh | 12 + .../q4_s4_validate_pvc_storageclass.sh | 12 + .../q5_s2_validate_container_image.sh | 18 + .../q6_s1_validate_multicontainer_pod.sh | 30 +- .../validation/q8_s2_validate_pod_running.sh | 27 +- .../validation/q8_s3_validate_cpu_usage.sh | 60 -- facilitator/assets/exams/ckad/002/answers.md | 574 +++++++++++----- .../assets/exams/ckad/002/assessment.json | 156 ++--- .../exams/ckad/002/scripts/setup/q12_setup.sh | 22 +- .../exams/ckad/002/scripts/setup/q15_setup.sh | 16 +- .../exams/ckad/002/scripts/setup/q18_setup.sh | 14 +- .../exams/ckad/002/scripts/setup/q19_setup.sh | 70 +- .../exams/ckad/002/scripts/setup/q9_setup.sh | 2 +- .../validation/q12_s1_validate_dockerfile.sh | 26 + .../validation/q12_s1_validate_namespace.sh | 13 - .../validation/q12_s2_validate_html.sh | 32 + .../validation/q12_s2_validate_statefulset.sh | 32 - .../validation/q12_s3_validate_image.sh | 12 + .../validation/q12_s3_validate_service.sh | 31 - .../validation/q12_s4_validate_container.sh | 32 + .../q12_s4_validate_volume_claim.sh | 32 - .../scripts/validation/q13_s2_validate_job.sh | 29 +- .../validation/q15_s1_validate_namespace.sh | 16 +- .../q15_s2_validate_chart_install.sh | 31 + .../validation/q15_s2_validate_values.sh | 70 ++ .../validation/q15_s3_validate_chart.sh | 61 ++ .../q15_s3_validate_release_notes.sh | 22 + .../q17_s5_validate_grace_period.sh | 4 +- .../validation/q18_s1_validate_namespace.sh | 16 +- .../scripts/validation/q18_s2_validate_crd.sh | 40 ++ .../validation/q18_s3_validate_cr_name.sh | 18 + .../validation/q18_s4_validate_cr_image.sh | 18 + .../validation/q18_s5_validate_cr_replicas.sh | 18 + .../validation/q19_s1_validate_namespace.sh | 16 +- .../q19_s2_validate_basic_output.sh | 41 ++ .../q19_s3_validate_advanced_output.sh | 46 ++ .../validation/q20_s1_validate_namespace.sh | 16 +- .../validation/q20_s2_validate_configmap.sh | 24 + .../validation/q20_s3_validate_secret.sh | 24 + .../validation/q20_s4_validate_env_vars.sh | 58 ++ .../q20_s5_validate_configmap_mount.sh | 25 + .../q9_s2_validate_deployment_replicas.sh | 13 + .../validation/q9_s4_validate_pods_image.sh | 18 + facilitator/assets/exams/cks/001/answers.md | 42 +- .../assets/exams/cks/001/assessment.json | 235 +------ .../scripts/validation/q10_s1_validate_pod.sh | 36 + .../q10_s1_validate_service_account.sh | 40 -- .../validation/q10_s2_validate_configmap.sh | 47 ++ .../validation/q10_s2_validate_pod_access.sh | 44 -- .../validation/q10_s3_validate_rbac_rules.sh | 64 -- .../validation/q10_s3_validate_syscalls.sh | 56 ++ .../validation/q6_s3_validate_rolebinding.sh | 45 ++ .../q8_s1_validate_policy_exists.sh | 22 + .../q8_s1_validate_sec_profile_exists.sh | 28 - .../validation/q8_s2_validate_default_deny.sh | 29 - .../q8_s2_validate_policy_selectors.sh | 36 + .../validation/q8_s3_validate_admin_access.sh | 68 ++ .../q8_s3_validate_allowed_syscalls.sh | 0 .../validation/q8_s4_validate_pod_seccomp.sh | 30 - .../q8_s4_validate_restricted_access.sh | 38 ++ .../validation/q9_s1_validate_enc_secret.sh | 0 .../validation/q9_s1_validate_pod_exists.sh | 29 + .../validation/q9_s2_validate_capabilities.sh | 35 + .../validation/q9_s2_validate_config_file.sh | 0 .../validation/q9_s3_validate_readonly_fs.sh | 39 ++ .../validation/q9_s4_validate_user_group.sh | 31 + facilitator/assets/exams/labs.json | 34 +- facilitator/assets/exams/other/001/answers.md | 404 +++++++++++ .../assets/exams/other/001/assessment.json | 449 +++++++++++++ .../assets/exams/other/001/config.json | 10 + .../other/001/scripts/setup/q10_setup.sh | 22 + .../other/001/scripts/setup/q11_setup.sh | 22 + .../other/001/scripts/setup/q12_setup.sh | 60 ++ .../other/001/scripts/setup/q13_setup.sh | 55 ++ .../other/001/scripts/setup/q14_setup.sh | 39 ++ .../other/001/scripts/setup/q15_setup.sh | 100 +++ .../other/001/scripts/setup/q16_setup.sh | 30 + .../exams/other/001/scripts/setup/q1_setup.sh | 26 + .../exams/other/001/scripts/setup/q2_setup.sh | 11 + .../exams/other/001/scripts/setup/q3_setup.sh | 14 + .../exams/other/001/scripts/setup/q4_setup.sh | 30 + .../exams/other/001/scripts/setup/q5_setup.sh | 27 + .../exams/other/001/scripts/setup/q6_setup.sh | 11 + .../exams/other/001/scripts/setup/q7_setup.sh | 14 + .../exams/other/001/scripts/setup/q8_setup.sh | 15 + .../exams/other/001/scripts/setup/q9_setup.sh | 14 + .../validation/q10_s1_validate_running.sh | 19 + .../scripts/validation/q10_s2_validate_cpu.sh | 23 + .../validation/q10_s3_validate_memory.sh | 23 + .../q11_s1_validate_compose_file.sh | 37 + .../validation/q11_s2_validate_services.sh | 38 ++ .../q11_s3_validate_network_volume.sh | 48 ++ .../validation/q12_s1_validate_file.sh | 17 + .../validation/q12_s2_validate_base_image.sh | 28 + .../validation/q12_s3_validate_details.sh | 53 ++ .../validation/q13_s1_validate_diagnosis.sh | 25 + .../q13_s2_validate_container_fixed.sh | 39 ++ .../validation/q14_s1_validate_dockerfile.sh | 35 + .../q14_s2_validate_container_user.sh | 46 ++ .../validation/q1_s1_validate_image_v1.sh | 13 + .../validation/q1_s2_validate_image_latest.sh | 13 + .../q2_s1_validate_container_running.sh | 19 + .../validation/q2_s2_validate_image.sh | 22 + .../scripts/validation/q2_s3_validate_port.sh | 23 + .../scripts/validation/q2_s4_validate_env.sh | 23 + .../validation/q3_s1_validate_volume.sh | 13 + .../q3_s2_validate_container_mount.sh | 23 + .../validation/q3_s3_validate_file_content.sh | 29 + .../validation/q4_s1_validate_dockerfile.sh | 19 + .../validation/q4_s2_validate_image_built.sh | 14 + .../validation/q4_s3_validate_image_size.sh | 23 + .../q5_s1_validate_daemon_config.sh | 21 + .../q5_s2_validate_cgroup_driver.sh | 23 + .../validation/q6_s1_validate_container.sh | 19 + .../validation/q6_s2_validate_log_driver.sh | 21 + .../validation/q6_s3_validate_log_rotation.sh | 27 + .../validation/q7_s1_validate_network.sh | 21 + .../scripts/validation/q7_s2_validate_app1.sh | 30 + .../scripts/validation/q7_s3_validate_ping.sh | 39 ++ .../validation/q8_s1_validate_dockerfile.sh | 33 + .../validation/q8_s2_validate_container.sh | 29 + .../q8_s3_validate_health_params.sh | 46 ++ .../validation/q9_s1_validate_manifest.sh | 25 + .../validation/q9_s2_validate_platforms.sh | 30 + facilitator/assets/exams/other/002/answers.md | 195 ++++++ .../assets/exams/other/002/assessment.json | 252 +++++++ .../assets/exams/other/002/config.json | 10 + .../002/scripts/setup/create_directories.sh | 14 + .../scripts/setup/q12_setup_buggy_release.sh | 93 +++ .../q10_s1_validate_chart_packaged.sh | 25 + .../validation/q10_s2_validate_local_repo.sh | 61 ++ .../validation/q11_s1_validate_rollback.sh | 40 ++ .../validation/q11_s2_validate_revision.sh | 53 ++ .../validation/q12_s1_validate_diagnosis.sh | 38 ++ .../validation/q12_s2_validate_fixed.sh | 56 ++ .../q1_s1_validate_helm_installed.sh | 35 + .../validation/q2_s1_validate_repo_added.sh | 39 ++ .../q3_s1_validate_search_results.sh | 36 + .../q4_s1_validate_nginx_installed.sh | 31 + .../q4_s2_validate_service_config.sh | 40 ++ .../q5_s1_validate_releases_list.sh | 50 ++ .../validation/q6_s1_validate_status.sh | 38 ++ .../validation/q6_s2_validate_manifests.sh | 38 ++ .../validation/q7_s1_validate_upgrade.sh | 34 + .../validation/q7_s2_validate_replicas.sh | 45 ++ .../validation/q8_s1_validate_values_file.sh | 44 ++ .../q8_s2_validate_redis_install.sh | 56 ++ .../q9_s1_validate_chart_created.sh | 32 + .../q9_s2_validate_chart_metadata.sh | 29 + facilitator/src/services/metricService.js | 2 +- facilitator/src/utils/logger.js | 10 +- facilitator/src/utils/redisClient.js | 20 +- jumphost/Dockerfile | 3 +- jumphost/scripts/cleanup-exam-env.sh | 8 + remote-desktop/Dockerfile | 2 +- remote-desktop/startup.sh | 2 +- scripts/COMPOSE-DEPLOY.md | 12 +- scripts/house-keeping/build-and-push.sh | 65 +- scripts/install.ps1 | 632 ++++++++++-------- scripts/install.sh | 4 +- 223 files changed, 8468 insertions(+), 1620 deletions(-) create mode 100644 LICENSE rename compose.yaml => docker-compose.yaml (100%) rename TERMS_OF_SERVICE.md => docs/TERMS_OF_SERVICE.md (100%) create mode 100644 facilitator/assets/exams/cka/001/answers.md create mode 100644 facilitator/assets/exams/cka/001/assessment.json create mode 100644 facilitator/assets/exams/cka/001/config.json create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q10_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q1_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q2_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q3_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q4_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q5_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q6_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q7_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q8_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/setup/q9_setup.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q10_s1_validate_pod.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q10_s2_validate_health_check_effectiveness.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q1_s1_validate_namespace.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q1_s2_validate_pod.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q1_s3_validate_pod_status.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q2_s1_validate_static_pod.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q2_s2_validate_static_pod_config.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q3_s1_validate_storageclass.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q3_s2_validate_pvc.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q3_s3_validate_storage_access.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q4_s1_validate_pod.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q4_s2_validate_logging.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q5_s1_validate_sa.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q5_s2_validate_rbac.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q5_s3_validate_rbac_permissions.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q6_s1_validate_networkpolicy.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q6_s2_validate_network_policy_effect.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q7_s1_validate_deployment.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q7_s2_validate_service.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q8_s1_validate_pod.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q8_s2_validate_resource_usage.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q9_s1_validate_configmap.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q9_s2_validate_pod.sh create mode 100644 facilitator/assets/exams/cka/001/scripts/validation/q9_s3_validate_configmap_usage.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q10_s2_validate_pod_running.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q10_s3_validate_pod_env_vars.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q11_s3_validate_cronjob_command.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q11_s4_validate_cronjob_policy.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q16_s2_validate_pod_selector.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q16_s3_validate_policy_rules.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q17_s2_validate_service_selector.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q17_s3_validate_service_ports.sh create mode 100755 facilitator/assets/exams/ckad/001/scripts/validation/q20_s1_validate_job_created.sh mode change 100644 => 100755 facilitator/assets/exams/ckad/001/scripts/validation/q20_s2_validate_job_config.sh create mode 100755 facilitator/assets/exams/ckad/001/scripts/validation/q20_s3_validate_job_completed.sh create mode 100755 facilitator/assets/exams/ckad/001/scripts/validation/q4_s3_validate_pvc_access_mode.sh create mode 100755 facilitator/assets/exams/ckad/001/scripts/validation/q4_s4_validate_pvc_storageclass.sh create mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q5_s2_validate_container_image.sh delete mode 100644 facilitator/assets/exams/ckad/001/scripts/validation/q8_s3_validate_cpu_usage.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_dockerfile.sh delete mode 100755 facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_namespace.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_html.sh delete mode 100755 facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_statefulset.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_image.sh delete mode 100755 facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_service.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_container.sh delete mode 100755 facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_volume_claim.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_chart_install.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_values.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_chart.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_release_notes.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q18_s2_validate_crd.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q18_s3_validate_cr_name.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q18_s4_validate_cr_image.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q18_s5_validate_cr_replicas.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q19_s2_validate_basic_output.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q19_s3_validate_advanced_output.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q20_s2_validate_configmap.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q20_s3_validate_secret.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q20_s4_validate_env_vars.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q20_s5_validate_configmap_mount.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q9_s2_validate_deployment_replicas.sh create mode 100644 facilitator/assets/exams/ckad/002/scripts/validation/q9_s4_validate_pods_image.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_pod.sh delete mode 100644 facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_service_account.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_configmap.sh delete mode 100644 facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_pod_access.sh delete mode 100644 facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_rbac_rules.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_syscalls.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q6_s3_validate_rolebinding.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_policy_exists.sh delete mode 100644 facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_sec_profile_exists.sh delete mode 100644 facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_default_deny.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_policy_selectors.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_admin_access.sh mode change 100644 => 100755 facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_allowed_syscalls.sh delete mode 100644 facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_pod_seccomp.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_restricted_access.sh mode change 100644 => 100755 facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_enc_secret.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_pod_exists.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_capabilities.sh mode change 100644 => 100755 facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_config_file.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q9_s3_validate_readonly_fs.sh create mode 100755 facilitator/assets/exams/cks/001/scripts/validation/q9_s4_validate_user_group.sh create mode 100644 facilitator/assets/exams/other/001/answers.md create mode 100644 facilitator/assets/exams/other/001/assessment.json create mode 100644 facilitator/assets/exams/other/001/config.json create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q10_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q11_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q12_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q13_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q14_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q15_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q16_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q1_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q2_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q3_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q4_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q5_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q6_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q7_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q8_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/setup/q9_setup.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q10_s1_validate_running.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q10_s2_validate_cpu.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q10_s3_validate_memory.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q11_s1_validate_compose_file.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q11_s2_validate_services.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q11_s3_validate_network_volume.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q12_s1_validate_file.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q12_s2_validate_base_image.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q12_s3_validate_details.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q13_s1_validate_diagnosis.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q13_s2_validate_container_fixed.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q14_s1_validate_dockerfile.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q14_s2_validate_container_user.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q1_s1_validate_image_v1.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q1_s2_validate_image_latest.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q2_s1_validate_container_running.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q2_s2_validate_image.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q2_s3_validate_port.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q2_s4_validate_env.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q3_s1_validate_volume.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q3_s2_validate_container_mount.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q3_s3_validate_file_content.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q4_s1_validate_dockerfile.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q4_s2_validate_image_built.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q4_s3_validate_image_size.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q5_s1_validate_daemon_config.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q5_s2_validate_cgroup_driver.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q6_s1_validate_container.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q6_s2_validate_log_driver.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q6_s3_validate_log_rotation.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q7_s1_validate_network.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q7_s2_validate_app1.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q7_s3_validate_ping.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q8_s1_validate_dockerfile.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q8_s2_validate_container.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q8_s3_validate_health_params.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q9_s1_validate_manifest.sh create mode 100644 facilitator/assets/exams/other/001/scripts/validation/q9_s2_validate_platforms.sh create mode 100644 facilitator/assets/exams/other/002/answers.md create mode 100644 facilitator/assets/exams/other/002/assessment.json create mode 100644 facilitator/assets/exams/other/002/config.json create mode 100644 facilitator/assets/exams/other/002/scripts/setup/create_directories.sh create mode 100644 facilitator/assets/exams/other/002/scripts/setup/q12_setup_buggy_release.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q10_s1_validate_chart_packaged.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q10_s2_validate_local_repo.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q11_s1_validate_rollback.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q11_s2_validate_revision.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q12_s1_validate_diagnosis.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q12_s2_validate_fixed.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q1_s1_validate_helm_installed.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q2_s1_validate_repo_added.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q3_s1_validate_search_results.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q4_s1_validate_nginx_installed.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q4_s2_validate_service_config.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q5_s1_validate_releases_list.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q6_s1_validate_status.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q6_s2_validate_manifests.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q7_s1_validate_upgrade.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q7_s2_validate_replicas.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q8_s1_validate_values_file.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q8_s2_validate_redis_install.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q9_s1_validate_chart_created.sh create mode 100644 facilitator/assets/exams/other/002/scripts/validation/q9_s2_validate_chart_metadata.sh diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..3e25ef0 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. \ No newline at end of file diff --git a/README.md b/README.md index ca8df7a..75c83c8 100644 --- a/README.md +++ b/README.md @@ -10,16 +10,26 @@ A powerful Kubernetes certification practice environment that provides a realist - **Docker-based deployment** for easy setup and consistent environment - **Timed exam mode** with real exam-like conditions and countdown timer + +## Demo Video + +Watch our live demo video showcasing the CK-X Simulator in action: + +[![CK-X Simulator Demo](https://img.youtube.com/vi/EQVGhF8x7R4/0.jpg)](https://www.youtube.com/watch?v=EQVGhF8x7R4&ab_channel=NishanB) + +Click the image above or [this link](https://www.youtube.com/watch?v=EQVGhF8x7R4&ab_channel=NishanB) to see the full demo. + + ## Installation -#### Linux & macOS +#### Linux & macOS (tested on m1) ```bash -bash <(curl -fsSL https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/install.sh) +bash <(curl -fsSL https://raw.githubusercontent.com/nishanb/ck-x/master/scripts/install.sh) ``` -#### Windows +#### Windows ( Currently not supported. Windows installation is unstable and may break during setup. ) ```powershell -irm https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/install.ps1 | iex +irm https://raw.githubusercontent.com/nishanb/ck-x/master/scripts/install.ps1 | iex ``` ### Manual Installation @@ -48,7 +58,7 @@ If you find CK-X Simulator helpful, consider [buying me a coffee](https://buymea ## Disclaimer -CK-X is an independent tool, not affiliated with CNCF, Linux Foundation, or PSI. We do not guarantee exam success. Please read our [Privacy Policy](PRIVACY_POLICY.md) and [Terms of Service](TERMS_OF_SERVICE.md) for more details about data collection, usage, and limitations. +CK-X is an independent tool, not affiliated with CNCF, Linux Foundation, or PSI. We do not guarantee exam success. Please read our [Privacy Policy](docs/PRIVACY_POLICY.md) and [Terms of Service](docs/TERMS_OF_SERVICE.md) for more details about data collection, usage, and limitations. ## Acknowledgments diff --git a/app/public/index.html b/app/public/index.html index f5e9eef..a59bd13 100644 --- a/app/public/index.html +++ b/app/public/index.html @@ -41,7 +41,7 @@
  • - + @@ -195,6 +195,7 @@ +
    @@ -203,16 +204,21 @@
    -
    +
    Select an exam to see its description.
    -
    - - +
    +
    + + +
    +
    + By clicking on Start exam, you accept our Privacy Policy +
    diff --git a/app/public/js/results.js b/app/public/js/results.js index 0e63c33..e6150da 100644 --- a/app/public/js/results.js +++ b/app/public/js/results.js @@ -38,7 +38,7 @@ document.addEventListener('DOMContentLoaded', function() { currentExamBtn.addEventListener('click', () => { if (currentExamId) { - window.location.href = `/exam.html?id=${currentExamId}`; + window.open(`/exam.html?id=${currentExamId}`, '_blank'); } else { showError('No exam ID available for redirection.'); } @@ -46,7 +46,7 @@ document.addEventListener('DOMContentLoaded', function() { viewAnswersBtn.addEventListener('click', () => { if (currentExamId) { - window.location.href = `/answers.html?id=${currentExamId}`; + window.open(`/answers.html?id=${currentExamId}`, '_blank'); } else { showError('No exam ID available for viewing answers.'); } diff --git a/compose.yaml b/docker-compose.yaml similarity index 100% rename from compose.yaml rename to docker-compose.yaml diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index 320e723..d06f008 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -4,7 +4,7 @@ Thank you for your interest in contributing! Here's how you can help: ## Quick Start -1. Fork and clone the [repository](https://github.com/nishanb/ck-x) +1. Fork and clone the [repository](https://github.com/@nishanb/CK-X) 2. Follow our [Development Setup Guide](docs/development-setup.md) 3. Create a new branch for your changes 4. Submit a Pull Request diff --git a/TERMS_OF_SERVICE.md b/docs/TERMS_OF_SERVICE.md similarity index 100% rename from TERMS_OF_SERVICE.md rename to docs/TERMS_OF_SERVICE.md diff --git a/docs/how-to-add-new-labs.md b/docs/how-to-add-new-labs.md index 3e7742d..ac92e42 100644 --- a/docs/how-to-add-new-labs.md +++ b/docs/how-to-add-new-labs.md @@ -12,6 +12,14 @@ Each lab in CK-X Simulator consists of: 4. **Setup and Verification Scripts** to prepare environments and validate student solutions 5. **Answers File** with solution documentation +# Considerations Before Creating a Lab +1. The cluster will consist of one control-plane node and multiple worker nodes. +2. SSH access to the nodes is not provided, which may restrict the development of labs that require access to Kubernetes internals or node internals. +3. All setup scripts will be executed simultaneously, so ensure that the questions are independent of each other. +4. Limit the setup to a maximum of two worker nodes to reduce system resource consumption during the exam. +5. When creating files in the cluster, use the /tmp/exam directory. This directory will be created during setup and removed during cleanup. + + ## Step 1: Create Lab Directory Structure First, create a directory structure for your lab using this pattern: @@ -62,7 +70,7 @@ Parameters: - `lab`: Unique identifier for the lab (should match directory structure) - `workerNodes`: Number of worker nodes required for this lab - `answers`: Path to answers markdown file -- `questions`: Path to assessment JSON file +- `questions`: sessment JSON filename - `totalMarks`: Maximum possible score - `lowScore`, `mediumScore`, `highScore`: Score thresholds for result categorization diff --git a/docs/local-setup-guide.md b/docs/local-setup-guide.md index d642785..a906761 100644 --- a/docs/local-setup-guide.md +++ b/docs/local-setup-guide.md @@ -4,7 +4,7 @@ 1. Clone the repository: ```bash -git clone https://github.com/nishanb/ck-x.git +git clone https://github.com/@nishanb/CK-X.git cd ck-x ``` @@ -13,6 +13,10 @@ cd ck-x ./scripts/compose-deploy.sh ``` +Alternatively, + +2. Use the command `docker compose up` and manually navigate to `http://localhost:30080` in your browser + The script will deploy all services locally and open the application in your browser. After making any changes to the code, you can redeploy with: diff --git a/facilitator/assets/exams/cka/001/answers.md b/facilitator/assets/exams/cka/001/answers.md new file mode 100644 index 0000000..991776b --- /dev/null +++ b/facilitator/assets/exams/cka/001/answers.md @@ -0,0 +1,343 @@ +# CKA Assessment Answers + +## Question 1: Namespace and Pod Creation + +Create a namespace named `app-team1` and create a pod named `nginx-pod` with the following specifications: +- Image: nginx:1.19 +- Namespace: app-team1 +- Label: run=nginx-pod + +```yaml +# Create namespace +kubectl create namespace app-team1 + +# Create pod +kubectl run nginx-pod --image=nginx:1.19 -n app-team1 --labels=run=nginx-pod +``` + +## Question 2: Static Pod Creation + +Create a static pod named `static-web` on ckad9999 with the following specifications: +- Image: nginx:1.19 +- Port: 80 + +```yaml +# Create static pod manifest +cat << EOF > /etc/kubernetes/manifests/static-web.yaml +apiVersion: v1 +kind: Pod +metadata: + name: static-web +spec: + containers: + - name: nginx + image: nginx:1.19 + ports: + - containerPort: 80 +EOF +``` + +## Question 3: Storage Setup + +Create a StorageClass named `fast-storage` and a PVC named `data-pvc` with the following specifications: + +StorageClass: +- Name: fast-storage +- Provisioner: kubernetes.io/no-provisioner +- Namespace: storage + +PVC: +- Name: data-pvc +- StorageClass: fast-storage +- Size: 1Gi +- Namespace: storage +- Access Mode: ReadWriteOnce + +```yaml +# Create storage namespace +kubectl create namespace storage + +# Create StorageClass +cat << EOF | kubectl apply -f - +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: fast-storage +provisioner: kubernetes.io/no-provisioner +EOF + +# Create PVC +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: data-pvc + namespace: storage +spec: + storageClassName: fast-storage + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +EOF +``` + +## Question 4: Logging Setup + +Create a pod named `logger` in the monitoring namespace with the following specifications: +- Container 1: busybox (writes logs to /var/log/app.log) +- Container 2: fluentd (reads logs from the same location) +- Use emptyDir volume to share logs between containers + +```yaml +# Create monitoring namespace +kubectl create namespace monitoring + +# Create pod +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: Pod +metadata: + name: logger + namespace: monitoring +spec: + containers: + - name: busybox + image: busybox + command: ['/bin/sh', '-c'] + args: + - while true; do + echo "$(date) - Application log entry" >> /var/log/app.log; + sleep 10; + done + volumeMounts: + - name: log-volume + mountPath: /var/log + - name: fluentd + image: fluentd + volumeMounts: + - name: log-volume + mountPath: /var/log + volumes: + - name: log-volume + emptyDir: {} +EOF +``` + +## Question 5: RBAC Setup + +Create a ServiceAccount named `app-sa` and configure RBAC to allow it to read pods in the default namespace. + +```yaml +# Create ServiceAccount +kubectl create serviceaccount app-sa + +# Create Role +cat << EOF | kubectl apply -f - +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: pod-reader +rules: +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] +EOF + +# Create RoleBinding +cat << EOF | kubectl apply -f - +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: read-pods +subjects: +- kind: ServiceAccount + name: app-sa +roleRef: + kind: Role + name: pod-reader + apiGroup: rbac.authorization.k8s.io +EOF +``` + +## Question 6: Network Policy + +Create a NetworkPolicy named `db-policy` in the networking namespace to allow only frontend pods to access the database pods on port 3306. + +```yaml +# Create networking namespace +kubectl create namespace networking + +# Create NetworkPolicy +cat << EOF | kubectl apply -f - +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: db-policy + namespace: networking +spec: + podSelector: + matchLabels: + role: db + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + role: frontend + ports: + - protocol: TCP + port: 3306 +EOF +``` + +## Question 7: Deployment and Service + +Create a Deployment named `web-app` with 3 replicas and a NodePort Service named `web-service` with the following specifications: + +Deployment: +- Name: web-app +- Image: nginx:1.19 +- Replicas: 3 + +Service: +- Name: web-service +- Type: NodePort +- Port: 80 +- Target Port: 80 + +```yaml +# Create Deployment +cat << EOF | kubectl apply -f - +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web-app +spec: + replicas: 3 + selector: + matchLabels: + app: web-app + template: + metadata: + labels: + app: web-app + spec: + containers: + - name: nginx + image: nginx:1.19 +EOF + +# Create Service +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: Service +metadata: + name: web-service +spec: + type: NodePort + ports: + - port: 80 + targetPort: 80 + selector: + app: web-app +EOF +``` + +## Question 8: Resource Management + +Create a pod named `resource-pod` in the monitoring namespace with the following resource specifications: +- CPU Request: 100m +- Memory Request: 128Mi +- CPU Limit: 200m +- Memory Limit: 256Mi + +```yaml +# Create pod +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: Pod +metadata: + name: resource-pod + namespace: monitoring +spec: + containers: + - name: nginx + image: nginx + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "200m" + memory: "256Mi" +EOF +``` + +## Question 9: ConfigMap and Pod + +Create a ConfigMap named `app-config` with a key `APP_COLOR` set to `blue` and create a pod named `config-pod` that mounts this ConfigMap at `/etc/config`. + +```yaml +# Create ConfigMap +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: ConfigMap +metadata: + name: app-config +data: + APP_COLOR: blue +EOF + +# Create pod +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: Pod +metadata: + name: config-pod +spec: + containers: + - name: nginx + image: nginx + volumeMounts: + - name: config-volume + mountPath: /etc/config + volumes: + - name: config-volume + configMap: + name: app-config +EOF +``` + +## Question 10: Health Checks + +Create a pod named `health-check` with the following health check specifications: +- Liveness Probe: HTTP GET / on port 80 +- Readiness Probe: HTTP GET / on port 80 +- Initial Delay: 5 seconds for both probes + +```yaml +# Create pod +cat << EOF | kubectl apply -f - +apiVersion: v1 +kind: Pod +metadata: + name: health-check +spec: + containers: + - name: nginx + image: nginx + livenessProbe: + httpGet: + path: / + port: 80 + initialDelaySeconds: 5 + readinessProbe: + httpGet: + path: / + port: 80 + initialDelaySeconds: 5 +EOF +``` \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/assessment.json b/facilitator/assets/exams/cka/001/assessment.json new file mode 100644 index 0000000..f8ef9a7 --- /dev/null +++ b/facilitator/assets/exams/cka/001/assessment.json @@ -0,0 +1,255 @@ +{ + "questions": [ + { + "id": "1", + "namespace": "app-team1", + "machineHostname": "ckad9999", + "question": "Create a pod named `nginx-pod` using the `nginx:1.19` image.\n\nEnsure the pod is created in the `app-team1` namespace and has the label `run=nginx-pod`.", + "concepts": ["pods", "labels", "namespaces"], + "verification": [ + { + "id": "1", + "description": "Pod exists in correct namespace", + "verificationScriptFile": "q1_s1_validate_namespace.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Pod has correct image", + "verificationScriptFile": "q1_s2_validate_pod.sh", + "expectedOutput": "0", + "weightage": 1 + }, + { + "id": "3", + "description": "Pod has correct status and configuration", + "verificationScriptFile": "q1_s3_validate_pod_status.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "2", + "namespace": "default", + "machineHostname": "ckad9999", + "question": "Create a static pod named `static-web` on `ckad9999` using the `nginx:1.19` image.\n\nPlace the static pod manifest file at `/etc/kubernetes/manifests/static-web.yaml`.", + "concepts": ["static pods", "node configuration"], + "verification": [ + { + "id": "1", + "description": "Static pod manifest exists", + "verificationScriptFile": "q2_s1_validate_static_pod.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Static pod manifest has correct configuration", + "verificationScriptFile": "q2_s2_validate_static_pod_config.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "3", + "namespace": "storage", + "machineHostname": "ckad9999", + "question": "Create a StorageClass named `fast-storage` with the provisioner `kubernetes.io/no-provisioner`.\n\nCreate a PersistentVolumeClaim named `data-pvc` in the `storage` namespace that uses this StorageClass.\n\nSet the access mode to `ReadWriteOnce` and request `1Gi` of storage.", + "concepts": ["storage", "storage classes", "persistent volumes"], + "verification": [ + { + "id": "1", + "description": "StorageClass and PVC exist", + "verificationScriptFile": "q3_s1_validate_storageclass.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "StorageClass has correct configuration", + "verificationScriptFile": "q3_s2_validate_pvc.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "4", + "namespace": "monitoring", + "machineHostname": "ckad9999", + "question": "Create a pod named `logger` with two containers:\n\n1. A `busybox` container that writes logs to `/var/log/app.log`\n2. A `fluentd` container that reads logs from the same location\n\nUse an `emptyDir` volume to share logs between containers.", + "concepts": ["multi-container pods", "volumes", "logging"], + "verification": [ + { + "id": "1", + "description": "Pod and containers exist", + "verificationScriptFile": "q4_s1_validate_pod.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Logging functionality is working", + "verificationScriptFile": "q4_s2_validate_logging.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "5", + "namespace": "default", + "machineHostname": "ckad9999", + "question": "Create a ServiceAccount named `app-sa`.\n\nCreate a Role named `pod-reader` that allows listing and getting pods.\n\nCreate a RoleBinding named `read-pods` that binds the `pod-reader` Role to the `app-sa` ServiceAccount.", + "concepts": ["RBAC", "service accounts", "roles"], + "verification": [ + { + "id": "1", + "description": "Service Account exist", + "verificationScriptFile": "q5_s1_validate_sa.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Role has correct permissions", + "verificationScriptFile": "q5_s2_validate_rbac.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "RBAC permissions are correctly configured", + "verificationScriptFile": "q5_s3_validate_rbac_permissions.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "6", + "namespace": "networking", + "machineHostname": "ckad9999", + "question": "Create a NetworkPolicy named `db-policy` in the `networking` namespace that:\n\n1. Allows pods with label `role=frontend` to connect to pods with label `role=db` on port `3306`\n2. Denies all other ingress traffic to pods with label `role=db`", + "concepts": ["network policies", "pod networking"], + "verification": [ + { + "id": "1", + "description": "NetworkPolicy exists", + "verificationScriptFile": "q6_s1_validate_networkpolicy.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Network policy is correctly configured and effective", + "verificationScriptFile": "q6_s2_validate_network_policy_effect.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "7", + "namespace": "default", + "machineHostname": "ckad9999", + "question": "Create a deployment named `web-app` with `3` replicas using the `nginx:1.19` image.\n\nCreate a NodePort service named `web-service` that exposes the deployment on port `80`.\n\nEnsure the pods are distributed across multiple nodes.", + "concepts": ["deployments", "services", "pod distribution"], + "verification": [ + { + "id": "1", + "description": "Deployment and service exist", + "verificationScriptFile": "q7_s1_validate_deployment.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Service has correct configuration", + "verificationScriptFile": "q7_s2_validate_service.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "8", + "namespace": "monitoring", + "machineHostname": "ckad9999", + "question": "Create a pod named `resource-pod` in the `monitoring` namespace with the following resource requirements:\n\n- CPU request: `100m`\n- CPU limit: `200m`\n- Memory request: `128Mi`\n- Memory limit: `256Mi`", + "concepts": ["resource management", "pod configuration"], + "verification": [ + { + "id": "1", + "description": "Pod exists with correct resource configuration", + "verificationScriptFile": "q8_s1_validate_pod.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Resource usage and limits are correct", + "verificationScriptFile": "q8_s2_validate_resource_usage.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "9", + "namespace": "default", + "machineHostname": "ckad9999", + "question": "Create a ConfigMap named `app-config` with the key `APP_COLOR` and value `blue`.\n\nCreate a pod named `config-pod` that mounts this ConfigMap as a volume at `/etc/config`.", + "concepts": ["configmaps", "volumes", "pod configuration"], + "verification": [ + { + "id": "1", + "description": "ConfigMap and pod exist", + "verificationScriptFile": "q9_s1_validate_configmap.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "ConfigMap has correct data", + "verificationScriptFile": "q9_s2_validate_pod.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "ConfigMap usage and mounting are correct", + "verificationScriptFile": "q9_s3_validate_configmap_usage.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "10", + "namespace": "default", + "machineHostname": "ckad9999", + "question": "Create a pod named `health-check` with the following health check configuration:\n\n- Liveness probe: HTTP GET on `/` port `80` with initial delay of `5` seconds\n- Readiness probe: HTTP GET on `/` port `80` with initial delay of `5` seconds", + "concepts": ["health checks", "pod lifecycle"], + "verification": [ + { + "id": "1", + "description": "Pod exists with health check configuration", + "verificationScriptFile": "q10_s1_validate_pod.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Health check effectiveness is verified", + "verificationScriptFile": "q10_s2_validate_health_check_effectiveness.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + } + ] +} \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/config.json b/facilitator/assets/exams/cka/001/config.json new file mode 100644 index 0000000..b596e83 --- /dev/null +++ b/facilitator/assets/exams/cka/001/config.json @@ -0,0 +1,10 @@ +{ + "lab": "cka-001", + "workerNodes": 2, + "answers": "assets/exams/cka/001/answers.md", + "questions": "assessment.json", + "totalMarks": 100, + "lowScore": 40, + "mediumScore": 60, + "highScore": 90 +} \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q10_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q10_setup.sh new file mode 100644 index 0000000..68b6cb1 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q10_setup.sh @@ -0,0 +1,28 @@ +#!/bin/bash +# Setup for Question 10: Health Check setup + +# Remove any existing pod with the same name +kubectl delete pod health-check --ignore-not-found=true + +# Pre-pull the nginx image +kubectl run prefetch-nginx --image=nginx --restart=Never --dry-run=client -o yaml | kubectl apply -f - + +# Create a ConfigMap with a custom nginx configuration that includes /healthz endpoint +kubectl create configmap nginx-health-config --from-literal=nginx.conf=' +events { + worker_connections 1024; +} +http { + server { + listen 80; + location /healthz { + access_log off; + return 200 "healthy\n"; + } + } +}' --dry-run=client -o yaml | kubectl apply -f - + +sleep 5 +kubectl delete pod prefetch-nginx --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q1_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q1_setup.sh new file mode 100644 index 0000000..3923110 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q1_setup.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# Setup for Question 1: Create namespace and pod + +# No specific setup needed as this is a creation task +# Just ensure the namespace doesn't exist already +kubectl delete namespace app-team1 --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q2_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q2_setup.sh new file mode 100644 index 0000000..3f30b5e --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q2_setup.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# Setup for Question 2: Static Pod setup + +# Ensure the static pod directory exists +mkdir -p /etc/kubernetes/manifests/ + +# Remove any existing static pod with the same name +rm -f /etc/kubernetes/manifests/static-web.yaml + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q3_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q3_setup.sh new file mode 100644 index 0000000..1608496 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q3_setup.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# Setup for Question 3: Storage setup + +# Create storage namespace if it doesn't exist +kubectl create namespace storage --dry-run=client -o yaml | kubectl apply -f - + +# Remove any existing storage class and PVC with the same names +kubectl delete storageclass fast-storage --ignore-not-found=true +kubectl delete pvc -n storage data-pvc --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q4_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q4_setup.sh new file mode 100644 index 0000000..dbef644 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q4_setup.sh @@ -0,0 +1,21 @@ +#!/bin/bash +# Setup for Question 4: Logging setup + +# Create monitoring namespace if it doesn't exist +kubectl create namespace monitoring --dry-run=client -o yaml | kubectl apply -f - + +# Remove any existing pod with the same name +kubectl delete pod -n monitoring logger --ignore-not-found=true + +# Pull required images in advance to speed up pod creation +kubectl run prefetch-busybox --image=busybox --restart=Never -n monitoring --dry-run=client -o yaml | kubectl apply -f - +kubectl run prefetch-fluentd --image=fluentd:v1.14 --restart=Never -n monitoring --dry-run=client -o yaml | kubectl apply -f - + +# Wait for prefetch pods to be created +sleep 5 + +# Clean up prefetch pods +kubectl delete pod -n monitoring prefetch-busybox --ignore-not-found=true +kubectl delete pod -n monitoring prefetch-fluentd --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q5_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q5_setup.sh new file mode 100644 index 0000000..996e43b --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q5_setup.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# Setup for Question 5: RBAC setup + +# Remove any existing resources with the same names +kubectl delete serviceaccount app-sa --ignore-not-found=true +kubectl delete role pod-reader --ignore-not-found=true +kubectl delete rolebinding read-pods --ignore-not-found=true + +# Create a test pod to verify RBAC permissions later +kubectl run test-pod --image=nginx --restart=Never --dry-run=client -o yaml | kubectl apply -f - + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q6_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q6_setup.sh new file mode 100644 index 0000000..0d1a07d --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q6_setup.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Setup for Question 6: Network Policy setup + +# Create networking namespace if it doesn't exist +kubectl create namespace networking --dry-run=client -o yaml | kubectl apply -f - + +# Remove any existing network policy +kubectl delete networkpolicy -n networking db-policy --ignore-not-found=true + +# Create test pods with appropriate labels +kubectl run frontend --image=nginx --labels=role=frontend -n networking --dry-run=client -o yaml | kubectl apply -f - +kubectl run db --image=mysql --labels=role=db -n networking --env=MYSQL_ROOT_PASSWORD=password --dry-run=client -o yaml | kubectl apply -f - + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q7_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q7_setup.sh new file mode 100644 index 0000000..338818c --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q7_setup.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# Setup for Question 7: Deployment and Service setup + +# Remove any existing deployment and service with the same names +kubectl delete deployment web-app --ignore-not-found=true +kubectl delete service web-service --ignore-not-found=true + +# Pre-pull the nginx image to speed up deployment creation +kubectl run prefetch-nginx --image=nginx:1.20 --restart=Never --dry-run=client -o yaml | kubectl apply -f - +sleep 5 +kubectl delete pod prefetch-nginx --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q8_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q8_setup.sh new file mode 100644 index 0000000..be89cba --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q8_setup.sh @@ -0,0 +1,15 @@ +#!/bin/bash +# Setup for Question 8: Resource Management setup + +# Ensure monitoring namespace exists +kubectl create namespace monitoring --dry-run=client -o yaml | kubectl apply -f - + +# Remove any existing pod with the same name +kubectl delete pod -n monitoring resource-pod --ignore-not-found=true + +# Pre-pull the nginx image +kubectl run prefetch-nginx --image=nginx --restart=Never -n monitoring --dry-run=client -o yaml | kubectl apply -f - +sleep 5 +kubectl delete pod -n monitoring prefetch-nginx --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/setup/q9_setup.sh b/facilitator/assets/exams/cka/001/scripts/setup/q9_setup.sh new file mode 100644 index 0000000..13b7821 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/setup/q9_setup.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# Setup for Question 9: ConfigMap setup + +# Remove any existing configmap and pod with the same names +kubectl delete configmap app-config --ignore-not-found=true +kubectl delete pod config-pod --ignore-not-found=true + +# Pre-pull the nginx image +kubectl run prefetch-nginx --image=nginx --restart=Never --dry-run=client -o yaml | kubectl apply -f - +sleep 5 +kubectl delete pod prefetch-nginx --ignore-not-found=true + +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q10_s1_validate_pod.sh b/facilitator/assets/exams/cka/001/scripts/validation/q10_s1_validate_pod.sh new file mode 100644 index 0000000..49fbd1f --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q10_s1_validate_pod.sh @@ -0,0 +1,70 @@ +#!/bin/bash +# Validate if pod with health checks exists with correct configuration + +POD_NAME="health-check" +EXPECTED_IMAGE="nginx" + +# Check if pod exists +if ! kubectl get pod $POD_NAME &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' exists but is not running (status: $POD_STATUS)" + exit 1 +fi + +# Check if correct image is used +POD_IMAGE=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].image}') +if [ "$POD_IMAGE" != "$EXPECTED_IMAGE" ]; then + echo "❌ Pod '$POD_NAME' using incorrect image: $POD_IMAGE (expected: $EXPECTED_IMAGE)" + exit 1 +fi + +# Check if liveness probe is configured +LIVENESS_PROBE=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.httpGet.path}') +if [ "$LIVENESS_PROBE" != "/" ]; then + echo "❌ Pod '$POD_NAME' missing liveness probe or incorrect path" + exit 1 +fi + +# Check if liveness probe port is correct +LIVENESS_PORT=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.httpGet.port}') +if [ "$LIVENESS_PORT" != "80" ]; then + echo "❌ Pod '$POD_NAME' has incorrect liveness probe port: $LIVENESS_PORT (expected: 80)" + exit 1 +fi + +# Check if readiness probe is configured +READINESS_PROBE=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.httpGet.path}') +if [ "$READINESS_PROBE" != "/" ]; then + echo "❌ Pod '$POD_NAME' missing readiness probe or incorrect path" + exit 1 +fi + +# Check if readiness probe port is correct +READINESS_PORT=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.httpGet.port}') +if [ "$READINESS_PORT" != "80" ]; then + echo "❌ Pod '$POD_NAME' has incorrect readiness probe port: $READINESS_PORT (expected: 80)" + exit 1 +fi + +# Check if probes have correct initial delay +LIVENESS_DELAY=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.initialDelaySeconds}') +READINESS_DELAY=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.initialDelaySeconds}') + +if [ "$LIVENESS_DELAY" != "5" ]; then + echo "❌ Pod '$POD_NAME' has incorrect liveness probe initial delay: $LIVENESS_DELAY (expected: 5)" + exit 1 +fi + +if [ "$READINESS_DELAY" != "5" ]; then + echo "❌ Pod '$POD_NAME' has incorrect readiness probe initial delay: $READINESS_DELAY (expected: 5)" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' exists with correct health check configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q10_s2_validate_health_check_effectiveness.sh b/facilitator/assets/exams/cka/001/scripts/validation/q10_s2_validate_health_check_effectiveness.sh new file mode 100644 index 0000000..9c139fb --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q10_s2_validate_health_check_effectiveness.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# Validate health check effectiveness + +POD_NAME="health-check" + +# Check if pod exists and is running +if ! kubectl get pod $POD_NAME &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found" + exit 1 +fi + +POD_STATUS=$(kubectl get pod $POD_NAME -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' is not running" + exit 1 +fi + +# Check liveness probe configuration +LIVENESS_PROBE=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.httpGet.path}') +LIVENESS_PORT=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.httpGet.port}') +LIVENESS_DELAY=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.initialDelaySeconds}') +LIVENESS_PERIOD=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].livenessProbe.periodSeconds}') + +if [ "$LIVENESS_PROBE" != "/" ]; then + echo "❌ Incorrect liveness probe path: $LIVENESS_PROBE" + exit 1 +fi + +if [ "$LIVENESS_PORT" != "80" ]; then + echo "❌ Incorrect liveness probe port: $LIVENESS_PORT" + exit 1 +fi + +if [ "$LIVENESS_DELAY" != "5" ]; then + echo "❌ Incorrect liveness probe initial delay: $LIVENESS_DELAY" + exit 1 +fi + +# Check readiness probe configuration +READINESS_PROBE=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.httpGet.path}') +READINESS_PORT=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.httpGet.port}') +READINESS_DELAY=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.initialDelaySeconds}') +READINESS_PERIOD=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].readinessProbe.periodSeconds}') + +if [ "$READINESS_PROBE" != "/" ]; then + echo "❌ Incorrect readiness probe path: $READINESS_PROBE" + exit 1 +fi + +if [ "$READINESS_PORT" != "80" ]; then + echo "❌ Incorrect readiness probe port: $READINESS_PORT" + exit 1 +fi + +if [ "$READINESS_DELAY" != "5" ]; then + echo "❌ Incorrect readiness probe initial delay: $READINESS_DELAY" + exit 1 +fi + +# Check if health endpoint is responding +POD_IP=$(kubectl get pod $POD_NAME -o jsonpath='{.status.podIP}') +if [ -z "$POD_IP" ]; then + echo "❌ Pod IP not found" + exit 1 +fi + +# Test health endpoint (root path for nginx) +if ! kubectl exec $POD_NAME -- curl -s http://localhost/ | grep -q "Welcome to nginx"; then + echo "❌ Root endpoint is not responding correctly" + exit 1 +fi + +# Check if pod has been restarted due to health check failures +RESTARTS=$(kubectl get pod $POD_NAME -o jsonpath='{.status.containerStatuses[0].restartCount}') +if [ "$RESTARTS" -gt 0 ]; then + echo "❌ Pod has been restarted $RESTARTS times" + exit 1 +fi + +# Check if pod is ready +READY=$(kubectl get pod $POD_NAME -o jsonpath='{.status.containerStatuses[0].ready}') +if [ "$READY" != "true" ]; then + echo "❌ Pod is not ready" + exit 1 +fi + +echo "✅ Health checks are correctly configured and working" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q1_s1_validate_namespace.sh b/facilitator/assets/exams/cka/001/scripts/validation/q1_s1_validate_namespace.sh new file mode 100644 index 0000000..72eb647 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q1_s1_validate_namespace.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# Validate if namespace app-team1 exists + +NAMESPACE="app-team1" + +if kubectl get namespace $NAMESPACE &> /dev/null; then + echo "✅ Namespace '$NAMESPACE' exists" + exit 0 +else + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q1_s2_validate_pod.sh b/facilitator/assets/exams/cka/001/scripts/validation/q1_s2_validate_pod.sh new file mode 100644 index 0000000..fe0c59b --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q1_s2_validate_pod.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Validate if nginx pod exists and is running in app-team1 namespace + +NAMESPACE="app-team1" +POD_NAME="nginx-pod" +EXPECTED_IMAGE="nginx:1.19" + +# Check if pod exists +if ! kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' exists but is not running (status: $POD_STATUS)" + exit 1 +fi + +# Check if correct image is used +POD_IMAGE=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].image}') +if [ "$POD_IMAGE" != "$EXPECTED_IMAGE" ]; then + echo "❌ Pod '$POD_NAME' is using incorrect image: $POD_IMAGE (expected: $EXPECTED_IMAGE)" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' exists, is running, and using correct image in namespace '$NAMESPACE'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q1_s3_validate_pod_status.sh b/facilitator/assets/exams/cka/001/scripts/validation/q1_s3_validate_pod_status.sh new file mode 100644 index 0000000..327ab26 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q1_s3_validate_pod_status.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# Validate pod status and readiness + +NAMESPACE="app-team1" +POD_NAME="nginx-pod" + +# Check if pod is ready +READY=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.containerStatuses[0].ready}') +if [ "$READY" != "true" ]; then + echo "❌ Pod '$POD_NAME' is not ready" + exit 1 +fi + +# Check if pod has restarted +RESTARTS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.containerStatuses[0].restartCount}') +if [ "$RESTARTS" != "0" ]; then + echo "❌ Pod '$POD_NAME' has restarted $RESTARTS times" + exit 1 +fi + +# Check if pod is running on a valid node +NODE=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.nodeName}') +if [ -z "$NODE" ]; then + echo "❌ Pod '$POD_NAME' is not assigned to any node" + exit 1 +fi + +# Check if pod has the correct labels +LABELS=$(kubectl get pod $POD_NAME -n $NAMESPACE --show-labels) +if [[ ! "$LABELS" =~ "run=nginx-pod" ]]; then + echo "❌ Pod '$POD_NAME' missing expected labels" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' has correct status and configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q2_s1_validate_static_pod.sh b/facilitator/assets/exams/cka/001/scripts/validation/q2_s1_validate_static_pod.sh new file mode 100644 index 0000000..d779f12 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q2_s1_validate_static_pod.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# Validate if static pod manifest exists in the correct location + +POD_NAME="static-web" +EXPECTED_IMAGE="nginx:1.19" + +# Check if the static pod manifest file exists +if [ ! -f "/etc/kubernetes/manifests/static-web.yaml" ]; then + echo "❌ Static pod manifest file not found at /etc/kubernetes/manifests/static-web.yaml" + exit 1 +fi + +# Verify the manifest is a valid yaml file +if ! grep -q "apiVersion: v1" "/etc/kubernetes/manifests/static-web.yaml"; then + echo "❌ Static pod manifest is not a valid Kubernetes yaml file" + exit 1 +fi + +# Verify it's a Pod resource +if ! grep -q "kind: Pod" "/etc/kubernetes/manifests/static-web.yaml"; then + echo "❌ Static pod manifest is not configured as a Pod resource" + exit 1 +fi + +# Verify the pod name +if ! grep -q "name: ${POD_NAME}" "/etc/kubernetes/manifests/static-web.yaml"; then + echo "❌ Static pod manifest does not have the correct pod name: ${POD_NAME}" + exit 1 +fi + +echo "✅ Static pod manifest exists at the correct location with proper configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q2_s2_validate_static_pod_config.sh b/facilitator/assets/exams/cka/001/scripts/validation/q2_s2_validate_static_pod_config.sh new file mode 100644 index 0000000..f421164 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q2_s2_validate_static_pod_config.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# Validate static pod manifest configuration + +POD_NAME="static-web" +EXPECTED_IMAGE="nginx:1.19" + +# Check if static pod manifest exists +if [ ! -f "/etc/kubernetes/manifests/static-web.yaml" ]; then + echo "❌ Static pod manifest not found at /etc/kubernetes/manifests/static-web.yaml" + exit 1 +fi + +# Check if manifest has correct content structure +if ! grep -q "apiVersion: v1" /etc/kubernetes/manifests/static-web.yaml; then + echo "❌ Static pod manifest missing apiVersion" + exit 1 +fi + +if ! grep -q "kind: Pod" /etc/kubernetes/manifests/static-web.yaml; then + echo "❌ Static pod manifest missing required content: not a Pod resource" + exit 1 +fi + +# Check if manifest has correct name +if ! grep -q "name: ${POD_NAME}" /etc/kubernetes/manifests/static-web.yaml; then + echo "❌ Static pod manifest has incorrect name" + exit 1 +fi + +# Check if manifest has correct image +if ! grep -q "image: ${EXPECTED_IMAGE}" /etc/kubernetes/manifests/static-web.yaml; then + echo "❌ Static pod manifest has incorrect image. Expected: ${EXPECTED_IMAGE}" + exit 1 +fi + +# Check if port 80 is defined +if ! grep -q "containerPort: 80" /etc/kubernetes/manifests/static-web.yaml; then + echo "❌ Static pod manifest missing containerPort: 80" + exit 1 +fi + +echo "✅ Static pod manifest has correct configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q3_s1_validate_storageclass.sh b/facilitator/assets/exams/cka/001/scripts/validation/q3_s1_validate_storageclass.sh new file mode 100644 index 0000000..f2a5d9c --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q3_s1_validate_storageclass.sh @@ -0,0 +1,21 @@ +#!/bin/bash +# Validate if StorageClass exists with correct configuration + +SC_NAME="fast-storage" +EXPECTED_PROVISIONER="kubernetes.io/no-provisioner" + +# Check if StorageClass exists +if ! kubectl get storageclass $SC_NAME &> /dev/null; then + echo "❌ StorageClass '$SC_NAME' not found" + exit 1 +fi + +# Check if correct provisioner is used +PROVISIONER=$(kubectl get storageclass $SC_NAME -o jsonpath='{.provisioner}') +if [ "$PROVISIONER" != "$EXPECTED_PROVISIONER" ]; then + echo "❌ StorageClass '$SC_NAME' using incorrect provisioner: $PROVISIONER (expected: $EXPECTED_PROVISIONER)" + exit 1 +fi + +echo "✅ StorageClass '$SC_NAME' exists with correct provisioner" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q3_s2_validate_pvc.sh b/facilitator/assets/exams/cka/001/scripts/validation/q3_s2_validate_pvc.sh new file mode 100644 index 0000000..132e18f --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q3_s2_validate_pvc.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# Validate if PVC exists with correct configuration + +NAMESPACE="storage" +PVC_NAME="data-pvc" +SC_NAME="fast-storage" +EXPECTED_SIZE="1Gi" + +# Check if PVC exists +if ! kubectl get pvc $PVC_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ PVC '$PVC_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if correct storage class is used +STORAGE_CLASS=$(kubectl get pvc $PVC_NAME -n $NAMESPACE -o jsonpath='{.spec.storageClassName}') +if [ "$STORAGE_CLASS" != "$SC_NAME" ]; then + echo "❌ PVC '$PVC_NAME' using incorrect storage class: $STORAGE_CLASS (expected: $SC_NAME)" + exit 1 +fi + +# Check if correct size is requested +SIZE=$(kubectl get pvc $PVC_NAME -n $NAMESPACE -o jsonpath='{.spec.resources.requests.storage}') +if [ "$SIZE" != "$EXPECTED_SIZE" ]; then + echo "❌ PVC '$PVC_NAME' requesting incorrect size: $SIZE (expected: $EXPECTED_SIZE)" + exit 1 +fi + +echo "✅ PVC '$PVC_NAME' exists with correct storage class and size" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q3_s3_validate_storage_access.sh b/facilitator/assets/exams/cka/001/scripts/validation/q3_s3_validate_storage_access.sh new file mode 100644 index 0000000..6301713 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q3_s3_validate_storage_access.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# Validate storage access and configuration + +NAMESPACE="storage" +PVC_NAME="data-pvc" +SC_NAME="fast-storage" + +# # Check if PVC is bound +# PVC_STATUS=$(kubectl get pvc $PVC_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +# if [ "$PVC_STATUS" != "Bound" ]; then +# echo "❌ PVC '$PVC_NAME' is not bound (status: $PVC_STATUS)" +# exit 1 +# fi + +# Check if StorageClass is default +SC_DEFAULT=$(kubectl get storageclass $SC_NAME -o jsonpath='{.metadata.annotations.storageclass\.kubernetes\.io/is-default-class}') +if [ "$SC_DEFAULT" != "true" ]; then + echo "❌ StorageClass '$SC_NAME' is not set as default" + exit 1 +fi + +# Check if StorageClass has correct reclaim policy +RECLAIM_POLICY=$(kubectl get storageclass $SC_NAME -o jsonpath='{.reclaimPolicy}') +if [ "$RECLAIM_POLICY" != "Delete" ]; then + echo "❌ StorageClass '$SC_NAME' has incorrect reclaim policy: $RECLAIM_POLICY" + exit 1 +fi + +# Check if PVC has correct access mode +ACCESS_MODE=$(kubectl get pvc $PVC_NAME -n $NAMESPACE -o jsonpath='{.spec.accessModes[0]}') +if [ "$ACCESS_MODE" != "ReadWriteOnce" ]; then + echo "❌ PVC '$PVC_NAME' has incorrect access mode: $ACCESS_MODE" + exit 1 +fi + +# Check if PVC has correct storage class +PVC_SC=$(kubectl get pvc $PVC_NAME -n $NAMESPACE -o jsonpath='{.spec.storageClassName}') +if [ "$PVC_SC" != "$SC_NAME" ]; then + echo "❌ PVC '$PVC_NAME' has incorrect storage class: $PVC_SC" + exit 1 +fi + +echo "✅ Storage configuration is correct" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q4_s1_validate_pod.sh b/facilitator/assets/exams/cka/001/scripts/validation/q4_s1_validate_pod.sh new file mode 100644 index 0000000..790d063 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q4_s1_validate_pod.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# Validate if logging pod exists with correct configuration + +NAMESPACE="monitoring" +POD_NAME="logger" +EXPECTED_CONTAINERS=2 + +# Check if pod exists +if ! kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' exists but is not running (status: $POD_STATUS)" + exit 1 +fi + +# Check if pod has two containers +CONTAINER_COUNT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[*].name}' | wc -w) +if [ "$CONTAINER_COUNT" -ne "$EXPECTED_CONTAINERS" ]; then + echo "❌ Pod '$POD_NAME' has incorrect number of containers: $CONTAINER_COUNT (expected: $EXPECTED_CONTAINERS)" + exit 1 +fi + +# Check if containers are using correct images +BUSYBOX_CONTAINER=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[?(@.image=="busybox")].name}') +FLUENTD_CONTAINER=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[?(@.image=="fluentd")].name}') + +if [ -z "$BUSYBOX_CONTAINER" ] || [ -z "$FLUENTD_CONTAINER" ]; then + echo "❌ Pod '$POD_NAME' is missing required containers with correct images" + exit 1 +fi + +# Check if volume mount is configured +LOG_MOUNT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].volumeMounts[?(@.mountPath=="/var/log")].mountPath}') +if [ -z "$LOG_MOUNT" ]; then + echo "❌ Volume mount '/var/log' not configured in pod '$POD_NAME'" + exit 1 +fi + +# Check if emptyDir volume is used +VOLUME_TYPE=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.volumes[?(@.name=="log-volume")].emptyDir}') +if [ -z "$VOLUME_TYPE" ]; then + echo "❌ Pod '$POD_NAME' is not using emptyDir volume type" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' exists with correct configuration and containers" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q4_s2_validate_logging.sh b/facilitator/assets/exams/cka/001/scripts/validation/q4_s2_validate_logging.sh new file mode 100644 index 0000000..7676aad --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q4_s2_validate_logging.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# Validate logging functionality + +NAMESPACE="monitoring" +POD_NAME="logger" + +# Check if log file exists and is being written to +kubectl exec -n $NAMESPACE $POD_NAME -c busybox -- ls -l /var/log/app.log &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Log file /var/log/app.log does not exist" + exit 1 +fi + +# Check if log file has recent entries +LOG_ENTRIES=$(kubectl exec -n $NAMESPACE $POD_NAME -c busybox -- wc -l /var/log/app.log | awk '{print $1}') +if [ "$LOG_ENTRIES" -lt 1 ]; then + echo "❌ Log file has no entries" + exit 1 +fi + +# Check if fluentd container is running +FLUENTD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.containerStatuses[?(@.name=="fluentd")].state.running}') +if [ -z "$FLUENTD_STATUS" ]; then + echo "❌ Fluentd container is not running" + exit 1 +fi + +# Check if fluentd has correct configuration +FLUENTD_CONFIG=$(kubectl exec -n $NAMESPACE $POD_NAME -c fluentd -- cat /fluentd/etc/fluent.conf) +if [[ ! "$FLUENTD_CONFIG" =~ "source" ]] || [[ ! "$FLUENTD_CONFIG" =~ "match" ]]; then + echo "❌ Fluentd configuration is incomplete" + exit 1 +fi + +# Check if log volume is properly mounted +VOLUME_MOUNT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.volumes[?(@.name=="log-volume")].emptyDir}') +if [ -z "$VOLUME_MOUNT" ]; then + echo "❌ Log volume is not properly configured" + exit 1 +fi + +echo "✅ Logging configuration is correct and functional" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q5_s1_validate_sa.sh b/facilitator/assets/exams/cka/001/scripts/validation/q5_s1_validate_sa.sh new file mode 100644 index 0000000..c9dfbdf --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q5_s1_validate_sa.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Validate if ServiceAccount exists + +SA_NAME="app-sa" +NAMESPACE="default" + +# Check if ServiceAccount exists +if ! kubectl get serviceaccount $SA_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ ServiceAccount '$SA_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +echo "✅ ServiceAccount '$SA_NAME' exists in namespace '$NAMESPACE'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q5_s2_validate_rbac.sh b/facilitator/assets/exams/cka/001/scripts/validation/q5_s2_validate_rbac.sh new file mode 100644 index 0000000..a2adf71 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q5_s2_validate_rbac.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# Validate if Role and RoleBinding exist with correct permissions + +NAMESPACE="default" +ROLE_NAME="pod-reader" +ROLEBINDING_NAME="read-pods" +SA_NAME="app-sa" + +# Check if Role exists +if ! kubectl get role $ROLE_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ Role '$ROLE_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if Role has correct permissions +VERBS=$(kubectl get role $ROLE_NAME -n $NAMESPACE -o jsonpath='{.rules[0].verbs[*]}') +RESOURCES=$(kubectl get role $ROLE_NAME -n $NAMESPACE -o jsonpath='{.rules[0].resources[*]}') + +if [[ ! "$VERBS" =~ "get" ]] || [[ ! "$VERBS" =~ "list" ]]; then + echo "❌ Role '$ROLE_NAME' missing required permissions (get and/or list)" + exit 1 +fi + +if [[ ! "$RESOURCES" =~ "pods" ]]; then + echo "❌ Role '$ROLE_NAME' not configured for pods resource" + exit 1 +fi + +# Check if RoleBinding exists +if ! kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ RoleBinding '$ROLEBINDING_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if RoleBinding links correct Role and ServiceAccount +BOUND_ROLE=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.roleRef.name}') +BOUND_SA=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.subjects[?(@.kind=="ServiceAccount")].name}') + +if [ "$BOUND_ROLE" != "$ROLE_NAME" ]; then + echo "❌ RoleBinding '$ROLEBINDING_NAME' not bound to correct role (found: $BOUND_ROLE, expected: $ROLE_NAME)" + exit 1 +fi + +if [ "$BOUND_SA" != "$SA_NAME" ]; then + echo "❌ RoleBinding '$ROLEBINDING_NAME' not bound to correct ServiceAccount (found: $BOUND_SA, expected: $SA_NAME)" + exit 1 +fi + +echo "✅ Role and RoleBinding exist with correct configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q5_s3_validate_rbac_permissions.sh b/facilitator/assets/exams/cka/001/scripts/validation/q5_s3_validate_rbac_permissions.sh new file mode 100644 index 0000000..943ecc4 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q5_s3_validate_rbac_permissions.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# Validate RBAC permissions + +NAMESPACE="default" +SA_NAME="app-sa" +ROLE_NAME="pod-reader" +ROLEBINDING_NAME="read-pods" + +# Check if Role has correct API groups +API_GROUPS=$(kubectl get role $ROLE_NAME -o jsonpath='{.rules[0].apiGroups[*]}') +if [[ ! "$API_GROUPS" =~ "" ]]; then + echo "❌ Role '$ROLE_NAME' has incorrect API groups" + exit 1 +fi + +# Check if Role has correct resource names +RESOURCE_NAMES=$(kubectl get role $ROLE_NAME -o jsonpath='{.rules[0].resourceNames[*]}') +if [ -n "$RESOURCE_NAMES" ]; then + echo "❌ Role '$ROLE_NAME' has unexpected resource names restriction" + exit 1 +fi + +# Check if RoleBinding has correct namespace +RB_NAMESPACE=$(kubectl get rolebinding $ROLEBINDING_NAME -o jsonpath='{.metadata.namespace}') +if [ "$RB_NAMESPACE" != "$NAMESPACE" ]; then + echo "❌ RoleBinding '$ROLEBINDING_NAME' is in wrong namespace" + exit 1 +fi + +# Test pod listing permission +if ! kubectl auth can-i list pods --as=system:serviceaccount:$NAMESPACE:$SA_NAME; then + echo "❌ ServiceAccount does not have permission to list pods" + exit 1 +fi + +# Test pod getting permission +if ! kubectl auth can-i get pods --as=system:serviceaccount:$NAMESPACE:$SA_NAME; then + echo "❌ ServiceAccount does not have permission to get pods" + exit 1 +fi + +echo "✅ RBAC permissions are correctly configured" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q6_s1_validate_networkpolicy.sh b/facilitator/assets/exams/cka/001/scripts/validation/q6_s1_validate_networkpolicy.sh new file mode 100644 index 0000000..4f89b1e --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q6_s1_validate_networkpolicy.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# Validate if NetworkPolicy exists with correct configuration + +NAMESPACE="networking" +POLICY_NAME="db-policy" +DB_LABEL="role=db" +FRONTEND_LABEL="role=frontend" + +# Check if NetworkPolicy exists +if ! kubectl get networkpolicy $POLICY_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ NetworkPolicy '$POLICY_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if policy targets pods with role=db label +TARGET_LABEL=$(kubectl get networkpolicy $POLICY_NAME -n $NAMESPACE -o jsonpath='{.spec.podSelector.matchLabels.role}') +if [ "$TARGET_LABEL" != "db" ]; then + echo "❌ NetworkPolicy '$POLICY_NAME' not targeting pods with label 'role=db'" + exit 1 +fi + +# Check if policy allows ingress from frontend pods +INGRESS_RULES=$(kubectl get networkpolicy $POLICY_NAME -n $NAMESPACE -o jsonpath='{.spec.ingress[*].from[*].podSelector.matchLabels.role}') +if [[ ! "$INGRESS_RULES" =~ "frontend" ]]; then + echo "❌ NetworkPolicy '$POLICY_NAME' not allowing ingress from pods with label 'role=frontend'" + exit 1 +fi + +# Check if policy allows port 3306 +ALLOWED_PORTS=$(kubectl get networkpolicy $POLICY_NAME -n $NAMESPACE -o jsonpath='{.spec.ingress[*].ports[*].port}') +if [[ ! "$ALLOWED_PORTS" =~ "3306" ]]; then + echo "❌ NetworkPolicy '$POLICY_NAME' not allowing port 3306" + exit 1 +fi + +echo "✅ NetworkPolicy '$POLICY_NAME' exists with correct configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q6_s2_validate_network_policy_effect.sh b/facilitator/assets/exams/cka/001/scripts/validation/q6_s2_validate_network_policy_effect.sh new file mode 100644 index 0000000..cbc191f --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q6_s2_validate_network_policy_effect.sh @@ -0,0 +1,42 @@ +#!/bin/bash +# Validate network policy effectiveness + +NAMESPACE="networking" +FRONTEND_POD="frontend" +DB_POD="db" + +# Check if frontend pod exists +if ! kubectl get pod $FRONTEND_POD -n $NAMESPACE &> /dev/null; then + echo "❌ Frontend pod not found" + exit 1 +fi + +# Check if db pod exists +if ! kubectl get pod $DB_POD -n $NAMESPACE &> /dev/null; then + echo "❌ Database pod not found" + exit 1 +fi + +# Check if network policy is applied to correct pods +POLICY_PODS=$(kubectl get networkpolicy db-policy -n $NAMESPACE -o jsonpath='{.spec.podSelector.matchLabels.role}') +if [ "$POLICY_PODS" != "db" ]; then + echo "❌ Network policy is not applied to correct pods" + exit 1 +fi + +# Check if network policy has correct policy types +POLICY_TYPES=$(kubectl get networkpolicy db-policy -n $NAMESPACE -o jsonpath='{.spec.policyTypes[*]}') +if [[ ! "$POLICY_TYPES" =~ "Ingress" ]]; then + echo "❌ Network policy missing Ingress policy type" + exit 1 +fi + +# Check if network policy has correct port configuration +POLICY_PORT=$(kubectl get networkpolicy db-policy -n $NAMESPACE -o jsonpath='{.spec.ingress[0].ports[0].port}') +if [ "$POLICY_PORT" != "3306" ]; then + echo "❌ Network policy has incorrect port configuration" + exit 1 +fi + +echo "✅ Network policy is correctly configured and effective" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q7_s1_validate_deployment.sh b/facilitator/assets/exams/cka/001/scripts/validation/q7_s1_validate_deployment.sh new file mode 100644 index 0000000..a30d078 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q7_s1_validate_deployment.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# Validate if Deployment exists with correct configuration + +DEPLOYMENT_NAME="web-app" +EXPECTED_REPLICAS=3 +EXPECTED_IMAGE="nginx:1.19" + +# Check if Deployment exists +if ! kubectl get deployment $DEPLOYMENT_NAME &> /dev/null; then + echo "❌ Deployment '$DEPLOYMENT_NAME' not found" + exit 1 +fi + +# Check if correct number of replicas +REPLICAS=$(kubectl get deployment $DEPLOYMENT_NAME -o jsonpath='{.spec.replicas}') +if [ "$REPLICAS" != "$EXPECTED_REPLICAS" ]; then + echo "❌ Deployment '$DEPLOYMENT_NAME' has incorrect number of replicas: $REPLICAS (expected: $EXPECTED_REPLICAS)" + exit 1 +fi + +# Check if correct image is used +POD_IMAGE=$(kubectl get deployment $DEPLOYMENT_NAME -o jsonpath='{.spec.template.spec.containers[0].image}') +if [ "$POD_IMAGE" != "$EXPECTED_IMAGE" ]; then + echo "❌ Deployment '$DEPLOYMENT_NAME' using incorrect image: $POD_IMAGE (expected: $EXPECTED_IMAGE)" + exit 1 +fi + +# Check if deployment is available +AVAILABLE=$(kubectl get deployment $DEPLOYMENT_NAME -o jsonpath='{.status.availableReplicas}') +if [ "$AVAILABLE" != "$EXPECTED_REPLICAS" ]; then + echo "❌ Deployment '$DEPLOYMENT_NAME' is not fully available (available: $AVAILABLE, expected: $EXPECTED_REPLICAS)" + exit 1 +fi + +echo "✅ Deployment '$DEPLOYMENT_NAME' exists with correct configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q7_s2_validate_service.sh b/facilitator/assets/exams/cka/001/scripts/validation/q7_s2_validate_service.sh new file mode 100644 index 0000000..2e17ae8 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q7_s2_validate_service.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# Validate if Service exists with correct configuration + +SERVICE_NAME="web-service" +EXPECTED_TYPE="NodePort" +EXPECTED_PORT=80 +EXPECTED_TARGET_PORT=80 + +# Check if Service exists +if ! kubectl get service $SERVICE_NAME &> /dev/null; then + echo "❌ Service '$SERVICE_NAME' not found" + exit 1 +fi + +# Check if service type is NodePort +SERVICE_TYPE=$(kubectl get service $SERVICE_NAME -o jsonpath='{.spec.type}') +if [ "$SERVICE_TYPE" != "$EXPECTED_TYPE" ]; then + echo "❌ Service '$SERVICE_NAME' has incorrect type: $SERVICE_TYPE (expected: $EXPECTED_TYPE)" + exit 1 +fi + +# Check if port is configured correctly +SERVICE_PORT=$(kubectl get service $SERVICE_NAME -o jsonpath='{.spec.ports[0].port}') +if [ "$SERVICE_PORT" != "$EXPECTED_PORT" ]; then + echo "❌ Service '$SERVICE_NAME' has incorrect port: $SERVICE_PORT (expected: $EXPECTED_PORT)" + exit 1 +fi + +# Check if target port is configured correctly +TARGET_PORT=$(kubectl get service $SERVICE_NAME -o jsonpath='{.spec.ports[0].targetPort}') +if [ "$TARGET_PORT" != "$EXPECTED_TARGET_PORT" ]; then + echo "❌ Service '$SERVICE_NAME' has incorrect target port: $TARGET_PORT (expected: $EXPECTED_TARGET_PORT)" + exit 1 +fi + +# Check if service has endpoints +ENDPOINTS=$(kubectl get endpoints $SERVICE_NAME -o jsonpath='{.subsets[*].addresses[*].ip}' | wc -w) +if [ "$ENDPOINTS" -eq 0 ]; then + echo "❌ Service '$SERVICE_NAME' has no endpoints" + exit 1 +fi + +echo "✅ Service '$SERVICE_NAME' exists with correct configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q8_s1_validate_pod.sh b/facilitator/assets/exams/cka/001/scripts/validation/q8_s1_validate_pod.sh new file mode 100644 index 0000000..ccf04b9 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q8_s1_validate_pod.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# Validate if resource-constrained pod exists with correct configuration + +NAMESPACE="monitoring" +POD_NAME="resource-pod" +EXPECTED_IMAGE="nginx" +EXPECTED_CPU_REQUEST="100m" +EXPECTED_MEMORY_REQUEST="128Mi" +EXPECTED_CPU_LIMIT="200m" +EXPECTED_MEMORY_LIMIT="256Mi" + +# Check if pod exists +if ! kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' exists but is not running (status: $POD_STATUS)" + exit 1 +fi + +# Check if correct image is used +POD_IMAGE=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].image}') +if [ "$POD_IMAGE" != "$EXPECTED_IMAGE" ]; then + echo "❌ Pod '$POD_NAME' using incorrect image: $POD_IMAGE (expected: $EXPECTED_IMAGE)" + exit 1 +fi + +# Check resource requests +CPU_REQUEST=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.requests.cpu}') +MEMORY_REQUEST=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.requests.memory}') + +if [ "$CPU_REQUEST" != "$EXPECTED_CPU_REQUEST" ]; then + echo "❌ Pod '$POD_NAME' has incorrect CPU request: $CPU_REQUEST (expected: $EXPECTED_CPU_REQUEST)" + exit 1 +fi + +if [ "$MEMORY_REQUEST" != "$EXPECTED_MEMORY_REQUEST" ]; then + echo "❌ Pod '$POD_NAME' has incorrect memory request: $MEMORY_REQUEST (expected: $EXPECTED_MEMORY_REQUEST)" + exit 1 +fi + +# Check resource limits +CPU_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.limits.cpu}') +MEMORY_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.limits.memory}') + +if [ "$CPU_LIMIT" != "$EXPECTED_CPU_LIMIT" ]; then + echo "❌ Pod '$POD_NAME' has incorrect CPU limit: $CPU_LIMIT (expected: $EXPECTED_CPU_LIMIT)" + exit 1 +fi + +if [ "$MEMORY_LIMIT" != "$EXPECTED_MEMORY_LIMIT" ]; then + echo "❌ Pod '$POD_NAME' has incorrect memory limit: $MEMORY_LIMIT (expected: $EXPECTED_MEMORY_LIMIT)" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' exists with correct resource configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q8_s2_validate_resource_usage.sh b/facilitator/assets/exams/cka/001/scripts/validation/q8_s2_validate_resource_usage.sh new file mode 100644 index 0000000..2ffc1f5 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q8_s2_validate_resource_usage.sh @@ -0,0 +1,73 @@ +#!/bin/bash +# Validate resource usage and limits + +NAMESPACE="monitoring" +POD_NAME="resource-pod" + +# Check if pod exists and is running +if ! kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found" + exit 1 +fi + +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' is not running" + exit 1 +fi + +# Check resource requests +CPU_REQUEST=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.requests.cpu}') +MEMORY_REQUEST=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.requests.memory}') + +if [ "$CPU_REQUEST" != "100m" ]; then + echo "❌ Incorrect CPU request: $CPU_REQUEST (expected: 100m)" + exit 1 +fi + +if [ "$MEMORY_REQUEST" != "128Mi" ]; then + echo "❌ Incorrect memory request: $MEMORY_REQUEST (expected: 128Mi)" + exit 1 +fi + +# Check resource limits +CPU_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.limits.cpu}') +MEMORY_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].resources.limits.memory}') + +if [ "$CPU_LIMIT" != "200m" ]; then + echo "❌ Incorrect CPU limit: $CPU_LIMIT (expected: 200m)" + exit 1 +fi + +if [ "$MEMORY_LIMIT" != "256Mi" ]; then + echo "❌ Incorrect memory limit: $MEMORY_LIMIT (expected: 256Mi)" + exit 1 +fi + +# Check actual resource usage +CPU_USAGE=$(kubectl top pod $POD_NAME -n $NAMESPACE --no-headers | awk '{print $2}') +MEMORY_USAGE=$(kubectl top pod $POD_NAME -n $NAMESPACE --no-headers | awk '{print $3}') + +# Convert CPU usage to millicores for comparison +CPU_MILLICORES=$(echo $CPU_USAGE | sed 's/m//') +if [ "$CPU_MILLICORES" -gt 200 ]; then + echo "❌ CPU usage exceeds limit: $CPU_USAGE" + exit 1 +fi + +# Convert memory usage to Mi for comparison +MEMORY_MI=$(echo $MEMORY_USAGE | sed 's/Mi//') +if [ "$MEMORY_MI" -gt 256 ]; then + echo "❌ Memory usage exceeds limit: $MEMORY_USAGE" + exit 1 +fi + +# Check if pod has been restarted due to resource issues +RESTARTS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.containerStatuses[0].restartCount}') +if [ "$RESTARTS" -gt 0 ]; then + echo "❌ Pod has been restarted $RESTARTS times" + exit 1 +fi + +echo "✅ Resource configuration and usage are correct" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q9_s1_validate_configmap.sh b/facilitator/assets/exams/cka/001/scripts/validation/q9_s1_validate_configmap.sh new file mode 100644 index 0000000..2066e39 --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q9_s1_validate_configmap.sh @@ -0,0 +1,28 @@ +#!/bin/bash +# Validate if ConfigMap exists with correct configuration + +CONFIGMAP_NAME="app-config" +EXPECTED_KEY="APP_COLOR" +EXPECTED_VALUE="blue" + +# Check if ConfigMap exists +if ! kubectl get configmap $CONFIGMAP_NAME &> /dev/null; then + echo "❌ ConfigMap '$CONFIGMAP_NAME' not found" + exit 1 +fi + +# Check if ConfigMap has the required key +if ! kubectl get configmap $CONFIGMAP_NAME -o jsonpath='{.data.APP_COLOR}' &> /dev/null; then + echo "❌ ConfigMap '$CONFIGMAP_NAME' missing required key '$EXPECTED_KEY'" + exit 1 +fi + +# Check if ConfigMap has the correct value +CONFIG_VALUE=$(kubectl get configmap $CONFIGMAP_NAME -o jsonpath='{.data.APP_COLOR}') +if [ "$CONFIG_VALUE" != "$EXPECTED_VALUE" ]; then + echo "❌ ConfigMap '$CONFIGMAP_NAME' has incorrect value for '$EXPECTED_KEY': $CONFIG_VALUE (expected: $EXPECTED_VALUE)" + exit 1 +fi + +echo "✅ ConfigMap '$CONFIGMAP_NAME' exists with correct configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q9_s2_validate_pod.sh b/facilitator/assets/exams/cka/001/scripts/validation/q9_s2_validate_pod.sh new file mode 100644 index 0000000..f00148f --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q9_s2_validate_pod.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# Validate if pod using ConfigMap exists with correct configuration + +POD_NAME="config-pod" +CONFIGMAP_NAME="app-config" +EXPECTED_IMAGE="nginx" + +# Check if pod exists +if ! kubectl get pod $POD_NAME &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' exists but is not running (status: $POD_STATUS)" + exit 1 +fi + +# Check if correct image is used +POD_IMAGE=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].image}') +if [ "$POD_IMAGE" != "$EXPECTED_IMAGE" ]; then + echo "❌ Pod '$POD_NAME' using incorrect image: $POD_IMAGE (expected: $EXPECTED_IMAGE)" + exit 1 +fi + +# Check if ConfigMap is mounted +CONFIGMAP_MOUNT=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.volumes[?(@.configMap.name=="app-config")].name}') +if [ -z "$CONFIGMAP_MOUNT" ]; then + echo "❌ Pod '$POD_NAME' not mounting ConfigMap '$CONFIGMAP_NAME'" + exit 1 +fi + +# Check if ConfigMap is mounted at correct path +MOUNT_PATH=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].volumeMounts[?(@.name=="config-volume")].mountPath}') +if [ "$MOUNT_PATH" != "/etc/config" ]; then + echo "❌ Pod '$POD_NAME' mounting ConfigMap at incorrect path: $MOUNT_PATH (expected: /etc/config)" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' exists with correct ConfigMap configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cka/001/scripts/validation/q9_s3_validate_configmap_usage.sh b/facilitator/assets/exams/cka/001/scripts/validation/q9_s3_validate_configmap_usage.sh new file mode 100644 index 0000000..0d2020e --- /dev/null +++ b/facilitator/assets/exams/cka/001/scripts/validation/q9_s3_validate_configmap_usage.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# Validate ConfigMap usage and mounting + +POD_NAME="config-pod" +CONFIGMAP_NAME="app-config" + +# Check if pod exists and is running +if ! kubectl get pod $POD_NAME &> /dev/null; then + echo "❌ Pod '$POD_NAME' not found" + exit 1 +fi + +POD_STATUS=$(kubectl get pod $POD_NAME -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' is not running" + exit 1 +fi + +# Check if ConfigMap exists +if ! kubectl get configmap $CONFIGMAP_NAME &> /dev/null; then + echo "❌ ConfigMap '$CONFIGMAP_NAME' not found" + exit 1 +fi + +# Check if ConfigMap has correct data +CONFIG_VALUE=$(kubectl get configmap $CONFIGMAP_NAME -o jsonpath='{.data.APP_COLOR}') +if [ "$CONFIG_VALUE" != "blue" ]; then + echo "❌ ConfigMap has incorrect value: $CONFIG_VALUE (expected: blue)" + exit 1 +fi + +# Check if volume is properly mounted +VOLUME_MOUNT=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.volumes[?(@.name=="config-volume")].configMap.name}') +if [ "$VOLUME_MOUNT" != "$CONFIGMAP_NAME" ]; then + echo "❌ ConfigMap is not properly mounted as volume" + exit 1 +fi + +# Check if volume is mounted at correct path +MOUNT_PATH=$(kubectl get pod $POD_NAME -o jsonpath='{.spec.containers[0].volumeMounts[?(@.name=="config-volume")].mountPath}') +if [ "$MOUNT_PATH" != "/etc/config" ]; then + echo "❌ ConfigMap is mounted at incorrect path: $MOUNT_PATH" + exit 1 +fi + +# Verify ConfigMap content in pod +POD_CONFIG_VALUE=$(kubectl exec $POD_NAME -- cat /etc/config/APP_COLOR) +if [ "$POD_CONFIG_VALUE" != "blue" ]; then + echo "❌ ConfigMap value not correctly mounted in pod" + exit 1 +fi + +# Check if pod can read the mounted ConfigMap +if ! kubectl exec $POD_NAME -- ls -l /etc/config/APP_COLOR &> /dev/null; then + echo "❌ Pod cannot access mounted ConfigMap file" + exit 1 +fi + +echo "✅ ConfigMap is correctly configured and mounted" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/answers.md b/facilitator/assets/exams/ckad/001/answers.md index f3648c9..179e87a 100644 --- a/facilitator/assets/exams/ckad/001/answers.md +++ b/facilitator/assets/exams/ckad/001/answers.md @@ -90,7 +90,7 @@ kubectl logs -n troubleshooting Potential fixes: 1. If the image is incorrect: ```bash - kubectl set image deployment/broken-app container-name=correct-image:tag -n troubleshooting + kubectl set image deployments -n troubleshooting broken-app app=nginx:latest ``` 2. If environment variables are missing: ```bash @@ -101,89 +101,109 @@ Potential fixes: kubectl patch deployment broken-app -n troubleshooting -p '{"spec":{"template":{"spec":{"containers":[{"name":"container-name","resources":{"limits":{"memory":"512Mi"}}}]}}}}' ``` -## Question 6: The kubelet on node 'worker-1' is not functioning properly. Diagnose and fix the issue +## Question 6: Create a multi-container pod with sidecar logging pattern -Troubleshooting steps: -```bash -# Check node status -kubectl get nodes - -# Describe the node for more information -kubectl describe node worker-1 - -# SSH into the worker node -ssh worker-1 - -# Check kubelet status -systemctl status kubelet - -# Check kubelet logs -journalctl -u kubelet -n 100 - -# Restart kubelet if needed -systemctl restart kubelet - -# Check kubelet configuration -cat /var/lib/kubelet/config.yaml +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: sidecar-pod + namespace: troubleshooting +spec: + containers: + - name: nginx + image: nginx + volumeMounts: + - name: log-volume + mountPath: /var/log + - name: sidecar + image: busybox + command: ["sh", "-c", "while true; do date >> /var/log/date.log; sleep 10; done"] + volumeMounts: + - name: log-volume + mountPath: /var/log + volumes: + - name: log-volume + emptyDir: {} ``` -Common kubelet issues: -1. Service not running: `systemctl start kubelet` -2. Configuration errors: Edit `/var/lib/kubelet/config.yaml` -3. Certificate issues: Renew certificates if needed -4. Disk space issues: `df -h` to check and clean up if needed +Save this as `sidecar-pod.yaml` and apply: + +```bash +kubectl apply -f sidecar-pod.yaml +``` + +You can verify the pod is working correctly: + +```bash +# Check that both containers are running in the pod +kubectl get pod sidecar-pod -n troubleshooting + +# Verify the shared volume is mounted and the log file is being written +kubectl exec -it sidecar-pod -n troubleshooting -c nginx -- cat /var/log/date.log + +# Check events related to the pod +kubectl describe pod sidecar-pod -n troubleshooting +``` ## Question 7: Service 'web-service' in namespace 'troubleshooting' is not routing traffic to pods properly. Identify and fix the issue Troubleshooting steps: ```bash -# Check the service +# Check the service configuration kubectl get svc web-service -n troubleshooting -# Describe the service to check selector labels +# Examine the service details to identify selector and port configuration issues kubectl describe svc web-service -n troubleshooting -# Check if there are pods matching the selector -kubectl get pods -l -n troubleshooting ``` -Common fixes: -1. Fix service selector to match pod labels: - ```bash - kubectl edit svc web-service -n troubleshooting - ``` -2. Fix pod labels to match service selector: - ```bash - kubectl label pods key=value -n troubleshooting - ``` -3. Fix service port mapping: - ```bash - kubectl edit svc web-service -n troubleshooting - ``` +Solution approach based on typical issues: -## Question 8: Pod 'logging-pod' in namespace 'troubleshooting' is experiencing high CPU usage. Identify the container causing the issue and take appropriate action to limit its CPU usage - -```bash -# Check current resource usage -kubectl top pod logging-pod -n troubleshooting -kubectl top pod logging-pod -n troubleshooting --containers - -# Add CPU limits to the container -kubectl patch pod logging-pod -n troubleshooting -p '{"spec":{"containers":[{"name":"","resources":{"limits":{"cpu":"200m"}}}]}}' -``` - -Or edit the deployment if the pod is managed by one: -```bash -kubectl edit deployment -n troubleshooting -``` - -Add the following to the container spec: +1. If the service selector doesn't match any pod labels, fix the service selector: ```yaml -resources: - limits: - cpu: 200m - requests: - cpu: 100m +apiVersion: v1 +kind: Service +metadata: + name: web-service + namespace: troubleshooting +spec: + selector: + app: web-app + ports: + - port: 80 + targetPort: 80 +``` + +2. Save as `fixed-service.yaml` and apply: +```bash +kubectl apply -f fixed-service.yaml +``` + +## Question 8: Pod 'logging-pod' in namespace 'troubleshooting' is consuming excessive CPU resources. Set appropriate CPU and memory limits + +Solution: +1. After identifying which container is causing high CPU usage, edit the pod to add resource limits: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: logging-pod + namespace: troubleshooting +spec: + containers: + - name: + # ... existing container configuration ... + resources: + limits: + cpu: 100m + memory: 50Mi +``` + +Edit the pod to add resource limits and will be saved to tmp/ +``` +kubectl replace -f tmp/ --force ``` ## Question 9: Create a ConfigMap named 'app-config' in namespace 'workloads' containing the following key-value pairs: APP_ENV=production, LOG_LEVEL=info. Then create a Pod named 'config-pod' using 'nginx' image that mounts these configurations as environment variables @@ -215,6 +235,13 @@ spec: configMapKeyRef: name: app-config key: LOG_LEVEL + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 256Mi ``` Save as `config-pod.yaml` and apply: @@ -239,7 +266,7 @@ metadata: spec: containers: - name: mysql - image: mysql:5.7 + image: mysql:latest env: - name: DB_USER valueFrom: @@ -256,6 +283,7 @@ spec: secretKeyRef: name: db-credentials key: password + restartPolicy: Always ``` Save as `secure-pod.yaml` and apply: @@ -263,39 +291,41 @@ Save as `secure-pod.yaml` and apply: kubectl apply -f secure-pod.yaml ``` -## Question 11: Create a Horizontal Pod Autoscaler for the deployment 'web-app' in namespace 'workloads' that scales between 2 and 6 replicas based on 70% CPU utilization +## Question 11: Create a CronJob named 'log-cleaner' in namespace 'workloads' that runs hourly to clean up log files -```bash -# Create the HPA -kubectl autoscale deployment web-app -n workloads --min=2 --max=6 --cpu-percent=70 -``` - -Or using YAML: ```yaml -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler +apiVersion: batch/v1 +kind: CronJob metadata: - name: web-app + name: log-cleaner namespace: workloads spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: web-app - minReplicas: 2 - maxReplicas: 6 - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 70 + schedule: "0 * * * *" # Run every hour at minute 0 + concurrencyPolicy: Forbid # Skip new job if previous is running + successfulJobsHistoryLimit: 3 # Keep 3 successful job completions + failedJobsHistoryLimit: 1 # Keep 1 failed job + jobTemplate: + spec: + template: + spec: + containers: + - name: log-cleaner + image: busybox + command: ["/bin/sh", "-c"] + args: + - find /var/log -type f -name "*.log" -mtime +7 -delete + restartPolicy: OnFailure ``` -Save as `hpa.yaml` and apply: +Save this as `log-cleaner-cronjob.yaml` and apply: + ```bash -kubectl apply -f hpa.yaml +kubectl apply -f log-cleaner-cronjob.yaml +``` + +You can check the cron job configuration: +```bash +kubectl get cronjob log-cleaner -n workloads -o yaml ``` ## Question 12: Create a Pod named 'health-pod' in namespace 'workloads' using 'nginx' image with a liveness probe that checks the path /healthz on port 80 every 15 seconds, and a readiness probe that checks port 80 every 10 seconds @@ -376,21 +406,30 @@ kubectl apply -f cluster-role.yaml kubectl apply -f cluster-role-binding.yaml ``` -## Question 14: Install Helm and use it to deploy the Prometheus monitoring stack in the 'monitoring' namespace +## Question 14: Deploy the Bitnami Nginx chart in the 'web' namespace using Helm ```bash -# Install Helm -curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash +# Create the namespace if it doesn't exist +kubectl create namespace web -# Create the namespace -kubectl create namespace monitoring +# Add the Bitnami charts repository +helm repo add bitnami https://charts.bitnami.com/bitnami -# Add Prometheus repo -helm repo add prometheus-community https://prometheus-community.github.io/helm-charts +# Update Helm repositories helm repo update -# Install Prometheus stack -helm install prometheus prometheus-community/kube-prometheus-stack --namespace monitoring +# Install Bitnami's Nginx chart with 2 replicas +helm install nginx bitnami/nginx --namespace web --set replicaCount=2 + +# Verify the deployment +kubectl get pods -n web +kubectl get svc -n web +``` + +You can inspect the installation and configuration: +```bash +helm list -n web +kubectl get deployment -n web ``` ## Question 15: Create a CRD (CustomResourceDefinition) for a new resource type 'Backup' in API group 'data.example.com' with version 'v1alpha1' that includes fields 'spec.source' and 'spec.destination' @@ -460,10 +499,6 @@ kubectl apply -f network-policy.yaml ## Question 17: Create a ClusterIP service named 'internal-app' in namespace 'networking' that routes traffic to pods with label 'app=backend' on port 8080, exposing the service on port 80 -```bash -kubectl create service clusterip internal-app --tcp=80:8080 -n networking --selector=app=backend -``` - Or using YAML: ```yaml apiVersion: v1 @@ -486,13 +521,8 @@ Save as `internal-service.yaml` and apply: kubectl apply -f internal-service.yaml ``` -## Question 18: Create a LoadBalancer service named 'public-web' in namespace 'networking' that exposes port 80 for the deployment 'web-frontend' +## Question 18: Create a NodePort service named public-web in namespace networking that will expose the web-frontend deployment to external users. -```bash -kubectl expose deployment web-frontend --type=LoadBalancer --port=80 --name=public-web -n networking -``` - -Or using YAML: ```yaml apiVersion: v1 kind: Service @@ -500,13 +530,16 @@ metadata: name: public-web namespace: networking spec: - type: LoadBalancer + type: NodePort selector: - app: web-frontend + app: web-frontend ports: - - port: 80 - targetPort: 80 - protocol: TCP + - name: http + protocol: TCP + port: 80 + targetPort: 8080 + nodePort: 30080 + ``` Save as `loadbalancer-service.yaml` and apply: @@ -541,24 +574,65 @@ Save as `ingress.yaml` and apply: kubectl apply -f ingress.yaml ``` -## Question 20: Configure CoreDNS to add a custom entry that resolves 'database.local' to the IP address 10.96.0.20 +## Question 20: Create a simple Kubernetes Job named 'hello-job' that executes a command and completes + +```yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: hello-job + namespace: networking +spec: + activeDeadlineSeconds: 30 + template: + spec: + containers: + - name: hello + image: busybox + command: ["sh", "-c", "echo 'Hello from Kubernetes job!'"] + restartPolicy: Never + backoffLimit: 0 +``` + +Save this as `hello-job.yaml` and apply: ```bash -# Edit the CoreDNS ConfigMap -kubectl edit configmap coredns -n kube-system +kubectl apply -f hello-job.yaml ``` -Add the following to the Corefile data: -``` -hosts { - 10.96.0.20 database.local - fallthrough -} -``` - -Restart CoreDNS pods: +You can check the job's status and output: ```bash -kubectl delete pod -l k8s-app=kube-dns -n kube-system +# Check job status +kubectl get jobs -n networking + +# View the pod created by the job +kubectl get pods -n networking -l job-name=hello-job + +# Check the logs to see the output message +kubectl logs -n networking -l job-name=hello-job ``` -Or create a custom ConfigMap with hosts entries and mount it in the CoreDNS deployment. +## Question 21: Work with the Open Container Initiative (OCI) format + +```bash +# Pull the image +docker pull nginx:latest + +# Save the image to a tarball +docker save nginx:latest -o /tmp/nginx-image.tar + +# Create the OCI directory +mkdir -p /root/oci-images + +# Extract the tarball to the OCI directory +tar -xf /tmp/nginx-image.tar -C /root/oci-images + +# Clean up the tarball +rm /tmp/nginx-image.tar +``` + +Check the result: +```bash +ls -la /root/oci-images +cat /root/oci-images/index.json # Verify it's in OCI format +``` \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/assessment.json b/facilitator/assets/exams/ckad/001/assessment.json index e6f9b15..bfcd181 100644 --- a/facilitator/assets/exams/ckad/001/assessment.json +++ b/facilitator/assets/exams/ckad/001/assessment.json @@ -78,7 +78,7 @@ "id": "3", "namespace": "storage-test", "machineHostname": "ckad9999", - "question": "As part of optimizing storage resources in the cluster, create a StorageClass named `slow-storage` that will dynamically provision storage resources. \n\nUse the provisioner `kubernetes.io/no-provisioner` for this local storage class. \n\nSet the volumeBindingMode to `WaitForFirstConsumer` to delay volume binding until a pod using the PVC is created. \n\nThis storage class will be used for applications that require optimized local storage performance.", + "question": "As part of optimizing storage resources in the cluster, create a StorageClass named `fast-storage` that will dynamically provision storage resources. \n\nUse the provisioner `kubernetes.io/no-provisioner` for this local storage class. \n\nSet the volumeBindingMode to `WaitForFirstConsumer` to delay volume binding until a pod using the PVC is created. \n\nThis storage class will be used for applications that require optimized local storage performance.", "concepts": ["storage-class", "provisioners", "volume-binding"], "verification": [ { @@ -214,7 +214,7 @@ "id": "8", "namespace": "troubleshooting", "machineHostname": "ckad9999", - "question": "The operations team has reported performance degradation in the cluster. \n\nPod `logging-pod` in namespace `troubleshooting` is consuming excessive CPU resources, affecting other workloads in the cluster. \n\nYour task is to: \n\n1. Identify which container within the pod is causing the high CPU usage \n\n2. Configure appropriate CPU limits for that container to prevent resource abuse while ensuring the application can still function \n\n3. Implement your solution by modifying the pod specification with the necessary resource constraints \n\nEnsure that the pod continues to run successfully after your changes, but with its CPU usage kept within reasonable bounds as defined by the limits you set.", + "question": "The operations team has reported performance degradation in the cluster. \n\nPod `logging-pod` in namespace `troubleshooting` is consuming excessive CPU resources, affecting other workloads in the cluster. \n\nYour task is to: \n\n1. Identify which container within the pod is causing the high CPU usage \n\n2. Configure appropriate CPU limits `100m` and memory limits `50Mi` for that container to prevent resource abuse while ensuring the application can still function \n\n3. Implement your solution by modifying the pod specification with the necessary resource constraints \n\nEnsure that the pod continues to run successfully after your changes, but with its CPU usage kept within reasonable bounds as defined by the limits you set.", "concepts": ["resource-limits", "resource-requests", "cpu-management", "troubleshooting"], "verification": [ { @@ -226,17 +226,10 @@ }, { "id": "2", - "description": "Pod is running", + "description": "CPU and Memory limits are configured correctly", "verificationScriptFile": "q8_s2_validate_pod_running.sh", "expectedOutput": "0", "weightage": 1 - }, - { - "id": "3", - "description": "CPU usage under threshold", - "verificationScriptFile": "q8_s3_validate_cpu_usage.sh", - "expectedOutput": "0", - "weightage": 2 } ] }, @@ -348,7 +341,7 @@ "id": "12", "namespace": "workloads", "machineHostname": "ckad9999", - "question": "To ensure application reliability, the team needs to implement health checking for a critical service. \n\nCreate a Pod named `health-pod` in namespace `workloads` using the `nginx` image with the following health monitoring configuration: \n\n1) A liveness probe that performs an HTTP GET request to the path `/healthz` on port `80` every 15 seconds to determine if the container is alive. If this check fails, Kubernetes will restart the container. \n\n2) A readiness probe that checks if the container is ready to serve traffic by testing if port `80` is open and accepting connections every 10 seconds. \n\nConfigure appropriate initial delay, timeout, and failure threshold values based on best practices.", + "question": "To ensure application reliability, the team needs to implement health checking for a critical service. \n\nCreate a Pod named `health-pod` in namespace `workloads` using the `emilevauge/whoami` image with the following health monitoring configuration: \n\n1) A liveness probe that performs an HTTP GET request to the path `/healthz` on port `80` every `15` seconds to determine if the container is alive. If this check fails, Kubernetes will restart the container. \n\n2) A readiness probe that checks if the container is ready to serve traffic by testing if port `80` is open and accepting connections every 10 seconds. \n\nConfigure appropriate initial delay, timeout, and failure threshold values based on best practices.", "concepts": ["pods", "probes", "liveness-probe", "readiness-probe", "health-checks"], "verification": [ { @@ -378,7 +371,7 @@ "id": "13", "namespace": "cluster-admin", "machineHostname": "ckad9999", - "question": "To implement proper access control and security segmentation in the cluster, you need to configure RBAC resources. \n\nFirst, create a `ClusterRole` named `pod-reader` that defines a set of permissions for pod operations. This role should specifically allow three operations on pods: `get` (view individual pods), `watch` (receive notifications about pod changes), and `list` (view collections of pods). \n\nNext, create a `ClusterRoleBinding` named `read-pods` that associates this role with the user `jane` in the namespace `cluster-admin`. \n\nThis binding will grant user `Jane` read-only access to pod resources across all namespaces in the cluster, following the principle of least privilege while allowing her to perform her monitoring duties.", + "question": "In the `cluster-admin` namespace, implement proper access control and security segmentation in the cluster by configuring RBAC resources. \n\nFirst, create a `ClusterRole` named `pod-reader` that defines a set of permissions for pod operations. This role should specifically allow three operations on pods: `get` (view individual pods), `watch` (receive notifications about pod changes), and `list` (view collections of pods). \n\nNext, create a `ClusterRoleBinding` named `read-pods` that associates this role with the user `jane` in the namespace `cluster-admin`. \n\nThis binding will grant user `Jane` read-only access to pod resources across all namespaces in the cluster, following the principle of least privilege while allowing her to perform her monitoring duties.", "concepts": ["rbac", "cluster-role", "cluster-role-binding", "authorization"], "verification": [ { @@ -507,7 +500,7 @@ "id": "18", "namespace": "networking", "machineHostname": "ckad9999", - "question": "A public-facing web application needs to be exposed to external users. \n\nCreate a NodePort service named `public-web` in namespace `networking` that will expose the `web-frontend` deployment to external users. \n\nConfigure the service to accept external traffic on port `80` and forward it to port `8080` on the deployment`s pods. Set the NodePort to `30080`. \n\nUsing a `NodePort` service will expose the application on a static port on each node in the cluster, making it accessible via any node`s IP address. \n\nEnsure the service selector correctly targets the `web-frontend` deployment pods and that the port configuration is appropriate for a web application. \n\nThis setup will enable external users to access the web application through `:30080`.", + "question": "A public-facing web application needs to be exposed to external users. \n\nCreate a NodePort service named `public-web` in namespace `networking` that will expose the `web-frontend` deployment to external users. \n\nConfigure the service to accept external traffic on port `80` and forward it to port `8080` on the deployment's pods. Set the NodePort to `30080`. \n\nUsing a `NodePort` service will expose the application on a static port on each node in the cluster, making it accessible via any node`s IP address. \n\nEnsure the service selector correctly targets the `web-frontend` deployment pods and that the port configuration is appropriate for a web application. \n\nThis setup will enable external users to access the web application through `:30080`.", "concepts": ["services", "nodeport", "networking", "exposing-apps"], "verification": [ { @@ -537,7 +530,7 @@ "id": "19", "namespace": "networking", "machineHostname": "ckad9999", - "question": "The API team needs to implement host-based routing for their services. \n\nCreate an Ingress resource named `api-ingress` in namespace `networking` that implements the following routing rule: \n\n- All HTTP traffic for the hostname `api.example.com` should be directed to the service `api-service` on port `80`. \n\nThis Ingress will utilize the cluster`s ingress controller to provide more sophisticated HTTP routing than is possible with Services alone. \n\nMake sure to properly configure the host field with the exact domain name and set up the correct backend service reference.", + "question": "The API team needs to implement host-based routing for their services. \n\nCreate an Ingress resource named `api-ingress` in namespace `networking` that implements the following routing rule: \n\n- All HTTP traffic for the hostname `api.example.com` should be directed to the service `api-service` on port `80`. \n\nThis Ingress will utilize the cluster's ingress controller to provide more sophisticated HTTP routing than is possible with Services alone. \n\nMake sure to properly configure the host field with the exact domain name and set up the correct backend service reference.", "concepts": ["ingress", "networking", "host-based-routing", "http-routing"], "verification": [ { @@ -567,15 +560,15 @@ "id": "20", "namespace": "networking", "machineHostname": "ckad9999", - "question": "A one-time configuration backup operation needs to be performed. \n\nCreate a Kubernetes Job named `backup-job` in the `networking` namespace to handle this task. \n\nThe job should create a single pod using the `busybox` image with a command that copies all files from the directory `/etc/config` to the `/backup` directory. \n\nConfigure the job with the following specifications: \n\n- Set `restartPolicy: Never` to ensure that containers are not restarted after completion or failure \n- Set `backoffLimit: 0` so that the job will not be retried if it fails \n\nThis job represents a one-time, batch operation that should either complete successfully or fail without retries, allowing administrators to then investigate any issues manually. \n\nVerify that the job completes successfully and that the files are properly copied to the destination directory.", + "question": "Create a simple batch processing task to demonstrate the Job resource type. \n\nCreate a Kubernetes Job named `hello-job` in the `networking` namespace that runs a pod with the `busybox` image. \n\nThe job should execute a single command that prints 'Hello from Kubernetes job!' to standard output, and then completes successfully. \n\nConfigure the job to: \n\n1. Run only once and not be restarted after completion \n2. Have a deadline of 30 seconds (the job will be terminated if it doesn't complete within this time) \n3. Use `Never` as the restart policy for the pod \n\nThis job demonstrates the basic pattern for one-time task execution in Kubernetes.", "concepts": ["jobs", "batch-processing", "pods", "containers"], "verification": [ { "id": "1", - "description": "Job is created and completes successfully", - "verificationScriptFile": "q20_s1_validate_job_completed.sh", + "description": "Job is created with correct name", + "verificationScriptFile": "q20_s1_validate_job_created.sh", "expectedOutput": "0", - "weightage": 3 + "weightage": 2 }, { "id": "2", @@ -583,6 +576,13 @@ "verificationScriptFile": "q20_s2_validate_job_config.sh", "expectedOutput": "0", "weightage": 2 + }, + { + "id": "3", + "description": "Job completes successfully", + "verificationScriptFile": "q20_s3_validate_job_completed.sh", + "expectedOutput": "0", + "weightage": 1 } ] }, diff --git a/facilitator/assets/exams/ckad/001/scripts/setup/q7_setup.sh b/facilitator/assets/exams/ckad/001/scripts/setup/q7_setup.sh index 7033a6f..6f05a0f 100755 --- a/facilitator/assets/exams/ckad/001/scripts/setup/q7_setup.sh +++ b/facilitator/assets/exams/ckad/001/scripts/setup/q7_setup.sh @@ -47,7 +47,7 @@ spec: app: web # Incorrect selector, should be app=web-app ports: - port: 80 - targetPort: 80 + targetPort: 3030 EOF echo "Setup complete for Question 7: Created service 'web-service' with incorrect selector" diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q10_s2_validate_pod_running.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q10_s2_validate_pod_running.sh new file mode 100644 index 0000000..85b464b --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q10_s2_validate_pod_running.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# Validate if the pod 'logging-pod' is running in the 'troubleshooting' namespace +POD_NAME="secure-pod" +NAMESPACE="workloads" + +# Check if the pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') + +if [ "$POD_STATUS" = "Running" ]; then + echo "Success: Pod '$POD_NAME' is running in namespace '$NAMESPACE'" + exit 0 +else + echo "Error: Pod '$POD_NAME' is not running in namespace '$NAMESPACE'" + exit 1 +fi diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q10_s3_validate_pod_env_vars.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q10_s3_validate_pod_env_vars.sh new file mode 100644 index 0000000..4173ce4 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q10_s3_validate_pod_env_vars.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +# Validate if the pod 'secure-pod' has the correct environment variables from Secret +POD_NAME="secure-pod" +NAMESPACE="workloads" + +# Expected secret name and keys +EXPECTED_SECRET="db-credentials" +EXPECTED_USER_KEY="username" +EXPECTED_PASSWORD_KEY="password" + +# Extract secret name and key used for DB_USER +DB_USER_SECRET=$(kubectl get pod "$POD_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.containers[0].env[?(@.name=='DB_USER')].valueFrom.secretKeyRef.name}") +DB_USER_KEY=$(kubectl get pod "$POD_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.containers[0].env[?(@.name=='DB_USER')].valueFrom.secretKeyRef.key}") + +# Extract secret name and key used for DB_PASSWORD +DB_PASSWORD_SECRET=$(kubectl get pod "$POD_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.containers[0].env[?(@.name=='DB_PASSWORD')].valueFrom.secretKeyRef.name}") +DB_PASSWORD_KEY=$(kubectl get pod "$POD_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.containers[0].env[?(@.name=='DB_PASSWORD')].valueFrom.secretKeyRef.key}") + +# Validate all +if [[ "$DB_USER_SECRET" == "$EXPECTED_SECRET" && "$DB_USER_KEY" == "$EXPECTED_USER_KEY" && + "$DB_PASSWORD_SECRET" == "$EXPECTED_SECRET" && "$DB_PASSWORD_KEY" == "$EXPECTED_PASSWORD_KEY" ]]; then + echo "✅ Success: Pod '$POD_NAME' has correct secret name and keys for env variables" + exit 0 +else + echo "❌ Error: Pod '$POD_NAME' does not have the correct secret configuration" + echo "DB_USER -> Secret: $DB_USER_SECRET, Key: $DB_USER_KEY" + echo "DB_PASSWORD -> Secret: $DB_PASSWORD_SECRET, Key: $DB_PASSWORD_KEY" + exit 1 +fi diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q11_s3_validate_cronjob_command.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q11_s3_validate_cronjob_command.sh new file mode 100644 index 0000000..a83390e --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q11_s3_validate_cronjob_command.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +CRONJOB_NAME="log-cleaner" +NAMESPACE="workloads" + +# Expected values +EXPECTED_COMMAND='["/bin/sh","-c"]' +EXPECTED_ARGS='find /var/log -type f -name "*.log" -mtime +7 -delete' + +# Fetch actual values from the CronJob +ACTUAL_COMMAND=$(kubectl get cronjob "$CRONJOB_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.jobTemplate.spec.template.spec.containers[0].command}") +ACTUAL_ARGS=$(kubectl get cronjob "$CRONJOB_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.jobTemplate.spec.template.spec.containers[0].args[0]}") + +# Compare +if [[ "$ACTUAL_COMMAND" == "$EXPECTED_COMMAND" && "$ACTUAL_ARGS" == "$EXPECTED_ARGS" ]]; then + echo "✅ Success: CronJob '$CRONJOB_NAME' has the correct command and args" + exit 0 +else + echo "❌ Error: CronJob '$CRONJOB_NAME' does not have the correct command/args" + echo "Actual command: $ACTUAL_COMMAND" + echo "Actual args: $ACTUAL_ARGS" + exit 1 +fi diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q11_s4_validate_cronjob_policy.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q11_s4_validate_cronjob_policy.sh new file mode 100644 index 0000000..8a33ea8 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q11_s4_validate_cronjob_policy.sh @@ -0,0 +1,28 @@ +#!/bin/bash + +CRONJOB_NAME="log-cleaner" +NAMESPACE="workloads" + +# Expected values +EXPECTED_CONCURRENCY_POLICY="Forbid" +EXPECTED_SUCCESSFUL_LIMIT="3" +EXPECTED_FAILED_LIMIT="1" + +# Fetch actual values from the CronJob spec +ACTUAL_CONCURRENCY_POLICY=$(kubectl get cronjob "$CRONJOB_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.concurrencyPolicy}") +ACTUAL_SUCCESSFUL_LIMIT=$(kubectl get cronjob "$CRONJOB_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.successfulJobsHistoryLimit}") +ACTUAL_FAILED_LIMIT=$(kubectl get cronjob "$CRONJOB_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.failedJobsHistoryLimit}") + +# Compare +if [[ "$ACTUAL_CONCURRENCY_POLICY" == "$EXPECTED_CONCURRENCY_POLICY" && \ + "$ACTUAL_SUCCESSFUL_LIMIT" == "$EXPECTED_SUCCESSFUL_LIMIT" && \ + "$ACTUAL_FAILED_LIMIT" == "$EXPECTED_FAILED_LIMIT" ]]; then + echo "✅ Success: CronJob '$CRONJOB_NAME' has correct concurrency policy and history limits" + exit 0 +else + echo "❌ Error: CronJob '$CRONJOB_NAME' has incorrect concurrency policy or history limits" + echo "ConcurrencyPolicy: $ACTUAL_CONCURRENCY_POLICY (expected: $EXPECTED_CONCURRENCY_POLICY)" + echo "SuccessfulJobsHistoryLimit: $ACTUAL_SUCCESSFUL_LIMIT (expected: $EXPECTED_SUCCESSFUL_LIMIT)" + echo "FailedJobsHistoryLimit: $ACTUAL_FAILED_LIMIT (expected: $EXPECTED_FAILED_LIMIT)" + exit 1 +fi diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q13_s2_validate_clusterrolebinding.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q13_s2_validate_clusterrolebinding.sh index 2cda467..595133e 100644 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q13_s2_validate_clusterrolebinding.sh +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q13_s2_validate_clusterrolebinding.sh @@ -1,51 +1,41 @@ #!/bin/bash -# Validate that the ClusterRoleBinding 'read-pods' correctly associates the 'pod-reader' role with user 'jane' +# Validate that the ClusterRoleBinding 'read-pods' correctly associates the 'pod-reader' ClusterRole with user 'jane' CLUSTERROLEBINDING_NAME="read-pods" CLUSTERROLE_NAME="pod-reader" USER_NAME="jane" -NAMESPACE="cluster-admin" # Check if the ClusterRoleBinding exists -kubectl get clusterrolebinding $CLUSTERROLEBINDING_NAME > /dev/null 2>&1 -if [ $? -ne 0 ]; then +if ! kubectl get clusterrolebinding "$CLUSTERROLEBINDING_NAME" > /dev/null 2>&1; then echo "❌ ClusterRoleBinding '$CLUSTERROLEBINDING_NAME' not found" exit 1 fi # Check if the ClusterRoleBinding references the correct ClusterRole -ROLE_REF=$(kubectl get clusterrolebinding $CLUSTERROLEBINDING_NAME -o jsonpath='{.roleRef.name}' 2>/dev/null) - +ROLE_REF=$(kubectl get clusterrolebinding "$CLUSTERROLEBINDING_NAME" -o jsonpath='{.roleRef.name}') if [ "$ROLE_REF" != "$CLUSTERROLE_NAME" ]; then echo "❌ ClusterRoleBinding '$CLUSTERROLEBINDING_NAME' references role '$ROLE_REF' instead of '$CLUSTERROLE_NAME'" exit 1 fi -# Check the roleRef kind - should be ClusterRole -ROLE_KIND=$(kubectl get clusterrolebinding $CLUSTERROLEBINDING_NAME -o jsonpath='{.roleRef.kind}' 2>/dev/null) - +# Check if the roleRef kind is 'ClusterRole' +ROLE_KIND=$(kubectl get clusterrolebinding "$CLUSTERROLEBINDING_NAME" -o jsonpath='{.roleRef.kind}') if [ "$ROLE_KIND" != "ClusterRole" ]; then echo "❌ ClusterRoleBinding '$CLUSTERROLEBINDING_NAME' references a '$ROLE_KIND' instead of a 'ClusterRole'" exit 1 fi -# Check if the ClusterRoleBinding has a subject for user 'jane' -SUBJECTS=$(kubectl get clusterrolebinding $CLUSTERROLEBINDING_NAME -o json | jq -r '.subjects[] | select(.name=="jane" and .kind=="User")' 2>/dev/null) +# Check if the ClusterRoleBinding binds to user 'jane' +SUBJECTS=$(kubectl get clusterrolebinding "$CLUSTERROLEBINDING_NAME" -o json) -if [ -z "$SUBJECTS" ]; then +USER_BOUND=$(echo "$SUBJECTS" | grep -A 2 '"kind": "User"' | grep -q "\"name\": \"$USER_NAME\"" && echo "yes" || echo "no") + +if [ "$USER_BOUND" != "yes" ]; then echo "❌ ClusterRoleBinding '$CLUSTERROLEBINDING_NAME' does not bind to user '$USER_NAME'" exit 1 fi -# Check if the namespace of the subject is specified as 'cluster-admin' -SUBJECT_NS=$(kubectl get clusterrolebinding $CLUSTERROLEBINDING_NAME -o json | jq -r '.subjects[] | select(.name=="jane" and .kind=="User") | .namespace' 2>/dev/null) - -if [ "$SUBJECT_NS" != "$NAMESPACE" ] && [ "$SUBJECT_NS" != "null" ]; then - echo "❌ ClusterRoleBinding subject namespace is '$SUBJECT_NS' instead of '$NAMESPACE'" - exit 1 -fi - # Success echo "✅ ClusterRoleBinding '$CLUSTERROLEBINDING_NAME' correctly associates ClusterRole '$CLUSTERROLE_NAME' with user '$USER_NAME'" -echo "✅ This binding grants Jane read-only access to pod resources across all namespaces" -exit 0 \ No newline at end of file +echo "✅ This binding grants '$USER_NAME' read-only access to pod resources across all namespaces" +exit 0 diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q16_s2_validate_pod_selector.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q16_s2_validate_pod_selector.sh new file mode 100644 index 0000000..14a2a2c --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q16_s2_validate_pod_selector.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Validate that NetworkPolicy 'allow-traffic' has correct pod selector: app=web + +NAMESPACE="networking" +POLICY_NAME="allow-traffic" +EXPECTED_KEY="app" +EXPECTED_VALUE="web" + +# Check if the NetworkPolicy exists +if ! kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" > /dev/null 2>&1; then + echo "❌ NetworkPolicy '$POLICY_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Fetch the podSelector key and value +ACTUAL_KEY=$(kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.podSelector.matchLabels}" | grep -o '"[^"]*":' | tr -d '"':) +ACTUAL_VALUE=$(kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.podSelector.matchLabels.$EXPECTED_KEY}") + +# Validate key and value +if [ "$ACTUAL_KEY" != "$EXPECTED_KEY" ] || [ "$ACTUAL_VALUE" != "$EXPECTED_VALUE" ]; then + echo "❌ NetworkPolicy '$POLICY_NAME' has incorrect podSelector" + echo "Expected: $EXPECTED_KEY=$EXPECTED_VALUE" + echo "Found: $ACTUAL_KEY=$ACTUAL_VALUE" + exit 1 +fi + +# Success +echo "✅ NetworkPolicy '$POLICY_NAME' has correct podSelector: $EXPECTED_KEY=$EXPECTED_VALUE" +exit 0 diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q16_s3_validate_policy_rules.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q16_s3_validate_policy_rules.sh new file mode 100644 index 0000000..7d25198 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q16_s3_validate_policy_rules.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# Validate that NetworkPolicy 'allow-traffic' has correct ingress rules: +# from pods with label tier=frontend and allows TCP on port 80 + +NAMESPACE="networking" +POLICY_NAME="allow-traffic" +EXPECTED_FROM_KEY="tier" +EXPECTED_FROM_VALUE="frontend" +EXPECTED_PROTOCOL="TCP" +EXPECTED_PORT="80" + +# Check if the NetworkPolicy exists +if ! kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" > /dev/null 2>&1; then + echo "❌ NetworkPolicy '$POLICY_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Validate podSelector in ingress.from +ACTUAL_FROM_VALUE=$(kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.ingress[0].from[0].podSelector.matchLabels.$EXPECTED_FROM_KEY}") +if [ "$ACTUAL_FROM_VALUE" != "$EXPECTED_FROM_VALUE" ]; then + echo "❌ Ingress rule does not match expected podSelector: $EXPECTED_FROM_KEY=$EXPECTED_FROM_VALUE" + echo "Found: $EXPECTED_FROM_KEY=$ACTUAL_FROM_VALUE" + exit 1 +fi + +# Validate port and protocol +ACTUAL_PORT=$(kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.ingress[0].ports[0].port}") +ACTUAL_PROTOCOL=$(kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.ingress[0].ports[0].protocol}") + +if [ "$ACTUAL_PORT" != "$EXPECTED_PORT" ] || [ "$ACTUAL_PROTOCOL" != "$EXPECTED_PROTOCOL" ]; then + echo "❌ Ingress rule does not allow expected port/protocol" + echo "Expected: $EXPECTED_PROTOCOL $EXPECTED_PORT" + echo "Found: $ACTUAL_PROTOCOL $ACTUAL_PORT" + exit 1 +fi + +# Success! +echo "✅ NetworkPolicy '$POLICY_NAME' has correct ingress rules: from pods with label '$EXPECTED_FROM_KEY=$EXPECTED_FROM_VALUE', allowing $EXPECTED_PROTOCOL on port $EXPECTED_PORT" +exit 0 diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q17_s2_validate_service_selector.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q17_s2_validate_service_selector.sh new file mode 100644 index 0000000..90124ca --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q17_s2_validate_service_selector.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# Validate that the 'internal-app' ClusterIP service has selector app=backend + +SERVICE_NAME="internal-app" +NAMESPACE="networking" +EXPECTED_KEY="app" +EXPECTED_VALUE="backend" + +# Check if the service exists +if ! kubectl get svc "$SERVICE_NAME" -n "$NAMESPACE" > /dev/null 2>&1; then + echo "❌ Service '$SERVICE_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Fetch selector key and value +ACTUAL_SELECTOR_VALUE=$(kubectl get svc "$SERVICE_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.selector.$EXPECTED_KEY}") + +if [ "$ACTUAL_SELECTOR_VALUE" != "$EXPECTED_VALUE" ]; then + echo "❌ Service selector mismatch" + echo "Expected: $EXPECTED_KEY=$EXPECTED_VALUE" + echo "Found: $EXPECTED_KEY=$ACTUAL_SELECTOR_VALUE" + exit 1 +fi + +# Success +echo "✅ Service '$SERVICE_NAME' in namespace '$NAMESPACE' has correct selector: $EXPECTED_KEY=$EXPECTED_VALUE" +exit 0 diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q17_s3_validate_service_ports.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q17_s3_validate_service_ports.sh new file mode 100644 index 0000000..6b812ba --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q17_s3_validate_service_ports.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# Validate that 'internal-app' ClusterIP service routes port 80 -> targetPort 8080 using TCP + +SERVICE_NAME="internal-app" +NAMESPACE="networking" +EXPECTED_PORT=80 +EXPECTED_TARGET_PORT=8080 +EXPECTED_PROTOCOL="TCP" + +# Check if the service exists +if ! kubectl get svc "$SERVICE_NAME" -n "$NAMESPACE" > /dev/null 2>&1; then + echo "❌ Service '$SERVICE_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Get actual values +ACTUAL_PORT=$(kubectl get svc "$SERVICE_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.ports[0].port}") +ACTUAL_TARGET_PORT=$(kubectl get svc "$SERVICE_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.ports[0].targetPort}") +ACTUAL_PROTOCOL=$(kubectl get svc "$SERVICE_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.ports[0].protocol}") + +# Validate port +if [ "$ACTUAL_PORT" != "$EXPECTED_PORT" ]; then + echo "❌ Service port is $ACTUAL_PORT, expected $EXPECTED_PORT" + exit 1 +fi + +# Validate targetPort +if [ "$ACTUAL_TARGET_PORT" != "$EXPECTED_TARGET_PORT" ]; then + echo "❌ Service targetPort is $ACTUAL_TARGET_PORT, expected $EXPECTED_TARGET_PORT" + exit 1 +fi + +# Validate protocol +if [ "$ACTUAL_PROTOCOL" != "$EXPECTED_PROTOCOL" ]; then + echo "❌ Service protocol is $ACTUAL_PROTOCOL, expected $EXPECTED_PROTOCOL" + exit 1 +fi + +# Success +echo "✅ Service '$SERVICE_NAME' correctly maps port $EXPECTED_PORT to targetPort $EXPECTED_TARGET_PORT using $EXPECTED_PROTOCOL" +exit 0 diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q19_s3_validate_ingress_backend.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q19_s3_validate_ingress_backend.sh index ba89bdb..1b67445 100644 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q19_s3_validate_ingress_backend.sh +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q19_s3_validate_ingress_backend.sh @@ -8,89 +8,41 @@ EXPECTED_SERVICE="api-service" EXPECTED_PORT=80 # Check if the ingress exists -kubectl get ingress $INGRESS_NAME -n $NAMESPACE > /dev/null 2>&1 -if [ $? -ne 0 ]; then +if ! kubectl get ingress "$INGRESS_NAME" -n "$NAMESPACE" > /dev/null 2>&1; then echo "❌ Ingress '$INGRESS_NAME' not found in namespace '$NAMESPACE'" exit 1 fi # Check if the service exists -kubectl get service $EXPECTED_SERVICE -n $NAMESPACE > /dev/null 2>&1 -if [ $? -ne 0 ]; then +if ! kubectl get service "$EXPECTED_SERVICE" -n "$NAMESPACE" > /dev/null 2>&1; then echo "⚠️ Service '$EXPECTED_SERVICE' not found in namespace '$NAMESPACE'" - # Continue with validation as the service might be created later fi -# Get API version to handle different Ingress structures -API_VERSION=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.apiVersion}' 2>/dev/null) -echo "ℹ️ Ingress API version: $API_VERSION" +# Extract hosts +HOSTS=$(kubectl get ingress "$INGRESS_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.rules[*].host}") +for HOST in $HOSTS; do + if [ "$HOST" = "$EXPECTED_HOST" ]; then + # For this host, get service names and ports + SERVICES=$(kubectl get ingress "$INGRESS_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.rules[?(@.host=='$HOST')].http.paths[*].backend.service.name}") + PORTS=$(kubectl get ingress "$INGRESS_NAME" -n "$NAMESPACE" -o jsonpath="{.spec.rules[?(@.host=='$HOST')].http.paths[*].backend.service.port.number}") -# Handle different API versions (v1 vs v1beta1) -if [[ "$API_VERSION" == "networking.k8s.io/v1" ]]; then - # For v1 API - RULE_INDEX=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --arg host "$EXPECTED_HOST" '.spec.rules | map(.host == $host) | index(true) // empty') - - if [ -z "$RULE_INDEX" ]; then - echo "❌ No rule found for host '$EXPECTED_HOST'" - exit 1 - fi - - # Check path-based rules - PATHS=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" '.spec.rules[$idx].http.paths[].path // "/"') - - for PATH in $PATHS; do - # For each path, check the backend service - BACKEND_SERVICE_NAME=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" --arg path "$PATH" '.spec.rules[$idx].http.paths[] | select(.path == $path or (.path == null and $path == "/")).backend.service.name // empty') - BACKEND_SERVICE_PORT=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" --arg path "$PATH" '.spec.rules[$idx].http.paths[] | select(.path == $path or (.path == null and $path == "/")).backend.service.port.number // empty') - - # If port is not a number, try getting it as a name - if [ -z "$BACKEND_SERVICE_PORT" ]; then - BACKEND_SERVICE_PORT=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" --arg path "$PATH" '.spec.rules[$idx].http.paths[] | select(.path == $path or (.path == null and $path == "/")).backend.service.port.name // empty') - fi - - echo "🔍 Path '$PATH' routes to service: $BACKEND_SERVICE_NAME, port: $BACKEND_SERVICE_PORT" - - if [ "$BACKEND_SERVICE_NAME" = "$EXPECTED_SERVICE" ]; then - # Check port - if [ "$BACKEND_SERVICE_PORT" = "$EXPECTED_PORT" ] || [ "$BACKEND_SERVICE_PORT" = "http" ]; then - echo "✅ Found correct backend service and port for path '$PATH'" - exit 0 - else - echo "⚠️ Service name matches but port is different: expected $EXPECTED_PORT, got $BACKEND_SERVICE_PORT" + INDEX=0 + for SERVICE in $SERVICES; do + PORT=$(echo $PORTS | awk -v idx=$((INDEX+1)) '{print $idx}') + echo "🔍 Host '$HOST' routes to service: $SERVICE, port: $PORT" + if [ "$SERVICE" = "$EXPECTED_SERVICE" ]; then + if [ "$PORT" = "$EXPECTED_PORT" ] || [ "$PORT" = "http" ]; then + echo "✅ Found correct backend service and port for host '$HOST'" + exit 0 + else + echo "⚠️ Service name matches but port is different: expected $EXPECTED_PORT, got $PORT" + fi fi - fi - done -else - # For v1beta1 or extensions/v1beta1 API - RULE_INDEX=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --arg host "$EXPECTED_HOST" '.spec.rules | map(.host == $host) | index(true) // empty') - - if [ -z "$RULE_INDEX" ]; then - echo "❌ No rule found for host '$EXPECTED_HOST'" - exit 1 + INDEX=$((INDEX+1)) + done fi - - # Check path-based rules - PATHS=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" '.spec.rules[$idx].http.paths[].path // "/"') - - for PATH in $PATHS; do - # For each path, check the backend service - BACKEND_SERVICE_NAME=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" --arg path "$PATH" '.spec.rules[$idx].http.paths[] | select(.path == $path or (.path == null and $path == "/")).backend.serviceName // empty') - BACKEND_SERVICE_PORT=$(kubectl get ingress $INGRESS_NAME -n $NAMESPACE -o json | jq -r --argjson idx "$RULE_INDEX" --arg path "$PATH" '.spec.rules[$idx].http.paths[] | select(.path == $path or (.path == null and $path == "/")).backend.servicePort // empty') - - echo "🔍 Path '$PATH' routes to service: $BACKEND_SERVICE_NAME, port: $BACKEND_SERVICE_PORT" - - if [ "$BACKEND_SERVICE_NAME" = "$EXPECTED_SERVICE" ]; then - # Check port - can be number or name - if [ "$BACKEND_SERVICE_PORT" = "$EXPECTED_PORT" ] || [ "$BACKEND_SERVICE_PORT" = "http" ]; then - echo "✅ Found correct backend service and port for path '$PATH'" - exit 0 - else - echo "⚠️ Service name matches but port is different: expected $EXPECTED_PORT, got $BACKEND_SERVICE_PORT" - fi - fi - done -fi +done -# If we get here, we didn't find the expected backend +# If we get here, it means validation failed echo "❌ Ingress does not route traffic to '$EXPECTED_SERVICE' on port $EXPECTED_PORT for host '$EXPECTED_HOST'" -exit 1 \ No newline at end of file +exit 1 diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q20_s1_validate_job_created.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q20_s1_validate_job_created.sh new file mode 100755 index 0000000..8278ab2 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q20_s1_validate_job_created.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Check if the Job is created with the correct name in the networking namespace + +JOB_NAME="hello-job" +NAMESPACE="networking" + +# Check if the job exists +if kubectl get job ${JOB_NAME} -n ${NAMESPACE} &> /dev/null; then + echo "✅ Job '${JOB_NAME}' exists in namespace '${NAMESPACE}'" + exit 0 +else + echo "❌ Job '${JOB_NAME}' does not exist in namespace '${NAMESPACE}'" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q20_s2_validate_job_config.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q20_s2_validate_job_config.sh old mode 100644 new mode 100755 index 1fa44c3..ea99d55 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q20_s2_validate_job_config.sh +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q20_s2_validate_job_config.sh @@ -2,7 +2,7 @@ # Validate that the Kubernetes Job 'backup-job' in namespace 'networking' has the correct configuration NAMESPACE="networking" -JOB_NAME="backup-job" +JOB_NAME="hello-job" EXPECTED_IMAGE="busybox" EXPECTED_RESTART_POLICY="Never" EXPECTED_BACKOFF_LIMIT=0 @@ -14,6 +14,15 @@ if [ $? -ne 0 ]; then exit 1 fi +# Check for activeDeadlineSeconds set to 30 +DEADLINE=$(kubectl get job $JOB_NAME -n $NAMESPACE -o jsonpath='{.spec.activeDeadlineSeconds}') +if [[ "$DEADLINE" == "30" ]]; then + echo "✅ Job has correct activeDeadlineSeconds value: 30" +else + echo "❌ Job has incorrect activeDeadlineSeconds value: ${DEADLINE:-not set}" + exit 1 +fi + # Check the job's backoffLimit BACKOFF_LIMIT=$(kubectl get job $JOB_NAME -n $NAMESPACE -o jsonpath='{.spec.backoffLimit}' 2>/dev/null) diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q20_s3_validate_job_completed.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q20_s3_validate_job_completed.sh new file mode 100755 index 0000000..7bbe566 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q20_s3_validate_job_completed.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# Check if the Job completes successfully + +JOB_NAME="hello-job" +NAMESPACE="networking" + +# Check if the job exists +if ! kubectl get job ${JOB_NAME} -n ${NAMESPACE} &> /dev/null; then + echo "❌ Job '${JOB_NAME}' does not exist in namespace '${NAMESPACE}'" + exit 1 +fi + +# Check if the job has completed +STATUS=$(kubectl get job ${JOB_NAME} -n ${NAMESPACE} -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') +if [[ "$STATUS" == "True" ]]; then + echo "✅ Job '${JOB_NAME}' has completed successfully" + + # Check if the job's pod generated the expected output + POD_NAME=$(kubectl get pods -n ${NAMESPACE} -l job-name=${JOB_NAME} -o jsonpath='{.items[0].metadata.name}') + if [ -n "$POD_NAME" ]; then + LOG=$(kubectl logs ${POD_NAME} -n ${NAMESPACE}) + if [[ "$LOG" == *"Hello from Kubernetes job!"* ]]; then + echo "✅ Job pod produced expected output: '$LOG'" + exit 0 + else + echo "❌ Job pod did not produce expected output. Found: '$LOG'" + exit 1 + fi + else + echo "⚠️ Could not find pod for job, but job shows as complete" + exit 0 + fi +else + # If not completed, check if it's still running (could be normal) + ACTIVE=$(kubectl get job ${JOB_NAME} -n ${NAMESPACE} -o jsonpath='{.status.active}') + if [[ "$ACTIVE" == "1" ]]; then + echo "⚠️ Job '${JOB_NAME}' is still running. Please wait for it to complete." + exit 1 + else + # If not active and not complete, check for failure + FAILED=$(kubectl get job ${JOB_NAME} -n ${NAMESPACE} -o jsonpath='{.status.failed}') + if [[ -n "$FAILED" && "$FAILED" -gt 0 ]]; then + echo "❌ Job '${JOB_NAME}' has failed with $FAILED failures" + + # Try to get logs from the failed pod for debugging + FAILED_POD=$(kubectl get pods -n ${NAMESPACE} -l job-name=${JOB_NAME} -o jsonpath='{.items[0].metadata.name}') + if [ -n "$FAILED_POD" ]; then + echo "❌ Error logs: $(kubectl logs ${FAILED_POD} -n ${NAMESPACE})" + fi + exit 1 + else + echo "❌ Job '${JOB_NAME}' has not completed and is not running" + exit 1 + fi + fi +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q3_s3_validate_storageclass_binding_mode.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q3_s3_validate_storageclass_binding_mode.sh index 10b38f5..5d21b7f 100755 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q3_s3_validate_storageclass_binding_mode.sh +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q3_s3_validate_storageclass_binding_mode.sh @@ -1,7 +1,7 @@ #!/bin/bash # Validate if the StorageClass 'slow-storage' has the correct volumeBindingMode -BINDING_MODE=$(kubectl get storageclass slow-storage -o jsonpath='{.volumeBindingMode}' 2>/dev/null) +BINDING_MODE=$(kubectl get storageclass fast-storage -o jsonpath='{.volumeBindingMode}' 2>/dev/null) if [ "$BINDING_MODE" = "WaitForFirstConsumer" ]; then echo "Success: StorageClass 'fast-storage' has the correct volumeBindingMode (WaitForFirstConsumer)" diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q4_s3_validate_pvc_access_mode.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q4_s3_validate_pvc_access_mode.sh new file mode 100755 index 0000000..d7eeb5f --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q4_s3_validate_pvc_access_mode.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +# Validate if PersistentVolumeClaim has correct access mode +ACCESS_MODE=$(kubectl get pvc pvc-app -n storage-test -o jsonpath='{.spec.accessModes[0]}' 2>/dev/null) + +if [ "$ACCESS_MODE" = "ReadWriteOnce" ]; then + echo "Success: PersistentVolumeClaim 'pvc-app' has the correct access mode (ReadWriteOnce)" + exit 0 +else + echo "Error: PersistentVolumeClaim 'pvc-app' does not have the correct access mode. Found: '$ACCESS_MODE', Expected: 'ReadWriteOnce'" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q4_s4_validate_pvc_storageclass.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q4_s4_validate_pvc_storageclass.sh new file mode 100755 index 0000000..ad1e7c0 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q4_s4_validate_pvc_storageclass.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +# Validate if PersistentVolumeClaim uses correct StorageClass +STORAGE_CLASS=$(kubectl get pvc pvc-app -n storage-test -o jsonpath='{.spec.storageClassName}' 2>/dev/null) + +if [ "$STORAGE_CLASS" = "fast-storage" ]; then + echo "Success: PersistentVolumeClaim 'pvc-app' uses correct StorageClass (fast-storage)" + exit 0 +else + echo "Error: PersistentVolumeClaim 'pvc-app' does not have the correct storage class. Found: '$STORAGE_CLASS', Expected: 'fast-storage'" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q5_s2_validate_container_image.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q5_s2_validate_container_image.sh new file mode 100644 index 0000000..7347705 --- /dev/null +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q5_s2_validate_container_image.sh @@ -0,0 +1,18 @@ +# validate the container image is correct having image name nginx +# Validate if the pods of deployment 'broken-app' are running in the 'troubleshooting' namespace +#check deployment status is runing or not +DEPLOYMENT_STATUS=$(kubectl get deployment broken-app -n troubleshooting -o jsonpath='{.status.conditions[?(@.type=="Available")].status}') +if [ "$DEPLOYMENT_STATUS" != "True" ]; then + echo "Error: The deployment 'broken-app' is not running" + exit 1 +fi + +IMAGE=$(kubectl get deployment broken-app -n troubleshooting -o jsonpath='{.spec.template.spec.containers[0].image}' | cut -d':' -f1) + +if [ "$IMAGE" == "nginx" ]; then + echo "Success: The container image is correct" + exit 0 +else + echo "Error: The container image is not correct" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q6_s1_validate_multicontainer_pod.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q6_s1_validate_multicontainer_pod.sh index 84abfb0..2813f68 100644 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q6_s1_validate_multicontainer_pod.sh +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q6_s1_validate_multicontainer_pod.sh @@ -1,30 +1,22 @@ #!/bin/bash -# Validate if the pod 'sidecar-pod' exists in the 'troubleshooting' namespace and has two containers +# Validate if the pod 'sidecar-pod' exists in the 'troubleshooting' namespace and has containers named 'nginx' and 'sidecar' POD_EXISTS=$(kubectl get pod sidecar-pod -n troubleshooting -o name 2>/dev/null) -CONTAINER_COUNT=$(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers}' 2>/dev/null | jq '. | length') if [ -z "$POD_EXISTS" ]; then echo "Error: Pod 'sidecar-pod' does not exist in namespace 'troubleshooting'" exit 1 fi -if [ "$CONTAINER_COUNT" -eq "2" ]; then - echo "Success: Pod 'sidecar-pod' exists and has two containers" - - # Verify container names and images - NGINX_CONTAINER=$(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers[?(@.image=="nginx")].name}' 2>/dev/null) - BUSYBOX_CONTAINER=$(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers[?(@.image=="busybox")].name}' 2>/dev/null) - - if [ -n "$NGINX_CONTAINER" ] && [ -n "$BUSYBOX_CONTAINER" ]; then - echo "Success: Pod has both nginx and busybox containers" - exit 0 - else - echo "Error: Pod does not have the required container images (nginx and busybox)" - echo "Found containers with images: $(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers[*].image}' 2>/dev/null)" - exit 1 - fi +# Verify container names +NGINX_CONTAINER=$(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers[?(@.name=="nginx")].name}' 2>/dev/null) +SIDECAR_CONTAINER=$(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers[?(@.name=="sidecar")].name}' 2>/dev/null) + +if [ -n "$NGINX_CONTAINER" ] && [ -n "$SIDECAR_CONTAINER" ]; then + echo "Success: Pod has both 'nginx' and 'sidecar' containers" + exit 0 else - echo "Error: Pod 'sidecar-pod' does not have two containers. Found: $CONTAINER_COUNT containers" + echo "Error: Pod does not have the required container names ('nginx' and 'sidecar')" + echo "Found containers with names: $(kubectl get pod sidecar-pod -n troubleshooting -o jsonpath='{.spec.containers[*].name}' 2>/dev/null)" exit 1 -fi \ No newline at end of file +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q8_s2_validate_pod_running.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q8_s2_validate_pod_running.sh index f526beb..47d645d 100644 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q8_s2_validate_pod_running.sh +++ b/facilitator/assets/exams/ckad/001/scripts/validation/q8_s2_validate_pod_running.sh @@ -1,6 +1,7 @@ #!/bin/bash # Validate that the 'logging-pod' is running in namespace 'troubleshooting' + NAMESPACE="troubleshooting" POD_NAME="logging-pod" @@ -12,29 +13,23 @@ if [ -z "$POD_STATUS" ]; then exit 1 fi +#validate `100m` and memory limits `50Mi` set for the container + # Check if the pod is running if [ "$POD_STATUS" != "Running" ]; then - echo "❌ Pod '$POD_NAME' exists but is not running (current status: $POD_STATUS)" - - # Get additional details about non-running pod - CONTAINER_STATUSES=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.containerStatuses[*].state}' 2>/dev/null) - - if [ -n "$CONTAINER_STATUSES" ]; then - echo "Container statuses: $CONTAINER_STATUSES" - fi - + echo "❌ Pod '$POD_NAME' exists but is not running (current status: $POD_STATUS)" exit 1 fi -# Check if all containers are ready -READY_COUNT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.containerStatuses[*].ready}' | grep -o "true" | wc -l) -CONTAINER_COUNT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[*].name}' | wc -w) +# Check if the container has the correct CPU and memory limits +CONTAINER_NAME=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].name}') +CPU_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath="{.spec.containers[?(@.name==\"$CONTAINER_NAME\")].resources.limits.cpu}") +MEMORY_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath="{.spec.containers[?(@.name==\"$CONTAINER_NAME\")].resources.limits.memory}") -if [ "$READY_COUNT" -ne "$CONTAINER_COUNT" ]; then - echo "❌ Pod '$POD_NAME' is running, but not all containers are ready ($READY_COUNT of $CONTAINER_COUNT ready)" +if [ "$CPU_LIMIT" != "100m" ] || [ "$MEMORY_LIMIT" != "50Mi" ]; then + echo "❌ Container '$CONTAINER_NAME' does not have the correct CPU and memory limits" exit 1 fi -# All checks passed -echo "✅ Pod '$POD_NAME' is running and all containers are ready" +echo "✅ Container '$CONTAINER_NAME' has the correct CPU and memory limits" exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/001/scripts/validation/q8_s3_validate_cpu_usage.sh b/facilitator/assets/exams/ckad/001/scripts/validation/q8_s3_validate_cpu_usage.sh deleted file mode 100644 index 10eed55..0000000 --- a/facilitator/assets/exams/ckad/001/scripts/validation/q8_s3_validate_cpu_usage.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# Validate that CPU usage for 'logging-pod' in namespace 'troubleshooting' is within acceptable limits - -NAMESPACE="troubleshooting" -POD_NAME="logging-pod" -# Setting a reasonable CPU usage threshold (in millicores) -CPU_THRESHOLD=800 - -# Check if the pod exists -kubectl get pod $POD_NAME -n $NAMESPACE > /dev/null 2>&1 -if [ $? -ne 0 ]; then - echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Get CPU limits from the pod -CONTAINERS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[*].name}') - -echo "🔍 Checking CPU usage for pod '$POD_NAME'..." - -# Use kubectl top to get current CPU usage -CPU_USAGE=$(kubectl top pod $POD_NAME -n $NAMESPACE --no-headers 2>/dev/null | awk '{print $2}') - -# Handle case where metrics-server might not be available -if [ -z "$CPU_USAGE" ]; then - echo "⚠️ Cannot measure actual CPU usage (metrics-server may not be available)" - echo "✅ Assuming CPU usage is acceptable since pod is running with limits" - exit 0 -fi - -# Extract numeric value from CPU usage (e.g., "156m" -> 156) -CPU_VALUE=$(echo $CPU_USAGE | sed 's/[^0-9]*//g') - -if [ -z "$CPU_VALUE" ]; then - echo "⚠️ Cannot parse CPU usage value: $CPU_USAGE" - echo "✅ Assuming CPU usage is acceptable since pod is running with limits" - exit 0 -fi - -echo "📊 Current CPU usage: ${CPU_VALUE}m" - -# Check against threshold -if [ $CPU_VALUE -gt $CPU_THRESHOLD ]; then - echo "❌ CPU usage (${CPU_VALUE}m) exceeds threshold (${CPU_THRESHOLD}m)" - exit 1 -fi - -# Check if all containers have CPU limits set -for CONTAINER in $CONTAINERS; do - CPU_LIMIT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath="{.spec.containers[?(@.name==\"$CONTAINER\")].resources.limits.cpu}") - - if [ -z "$CPU_LIMIT" ]; then - echo "⚠️ Container '$CONTAINER' does not have CPU limits set" - else - echo "✅ Container '$CONTAINER' has CPU limits: $CPU_LIMIT" - fi -done - -echo "✅ CPU usage is within acceptable limits" -exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/answers.md b/facilitator/assets/exams/ckad/002/answers.md index 20ae9e6..f2f7042 100644 --- a/facilitator/assets/exams/ckad/002/answers.md +++ b/facilitator/assets/exams/ckad/002/answers.md @@ -1,6 +1,6 @@ # CKAD-002 Lab Answers -This document contains solutions for all questions in the CKAD-002 lab, which is based on the CKAD-exercises repository by dgkanatsios. +This document contains solutions for all questions in the CKAD-002 lab ## Question 1: Core Concepts @@ -509,203 +509,457 @@ spec: EOF ``` -## Question 19: Pod Networking +## Question 11: Security Context -### Task: -Create a pod with specific networking configurations: - -1. Create a namespace called `pod-networking` -2. Create a pod named `network-pod` in the `pod-networking` namespace with the image `nginx:alpine` -3. Configure the pod with the following: - - Hostname set to `custom-host` - - Subdomain set to `example` - - DNS Policy set to `ClusterFirstWithHostNet` - - Add custom DNS configuration: - - Nameservers: `8.8.8.8` and `8.8.4.4` - - Searches: `example.com` - -### Solution: - -First, create the namespace: +Create a Pod with security configurations: ```bash -kubectl create namespace pod-networking -``` +# Create namespace +kubectl create namespace security -Then, create a YAML file for the pod with the required networking configurations: - -```yaml +# Create secure pod +cat < /tmp/Dockerfile << 'EOF' +FROM nginx:alpine +COPY index.html /usr/share/nginx/html/ +EXPOSE 80 +EOF + +# Create the HTML file +cat > /tmp/index.html << 'EOF' + + + +

    Hello from CKAD Docker Question!

    + + +EOF + +# Build the Docker image +docker build -t my-nginx:v1 -f /tmp/Dockerfile /tmp + +# Run the container +docker run -d --name my-web -p 8080:80 my-nginx:v1 + +# Verify the container is running +docker ps | grep my-web ``` -Verify the pod is running: +## Question 13: Jobs + +Create a Job with specific configurations: ```bash -kubectl get pod -n pod-networking +# Create namespace +kubectl create namespace jobs + +# Create Job +cat < /tmp/release-notes.txt +``` + +These commands: +1. Create a namespace called `helm-basics` +2. Add the Bitnami Helm chart repository and update it to get the latest charts +3. Install the nginx chart from Bitnami in the helm-basics namespace with the release name "nginx-release" +4. Save the release notes to /tmp/release-notes.txt using the `helm get notes` command + +## Question 16: Health Checks + +Create a Pod with multiple health probes: + +```bash +# Create namespace +kubectl create namespace health-checks + +# Create Pod with startup, liveness, and readiness probes +cat < /usr/share/nginx/html/welcome.txt"] + preStop: + exec: + command: ["/bin/sh", "-c", "sleep 10"] + terminationGracePeriodSeconds: 30 +EOF +``` + +## Question 18: Custom Resource Definitions + +Create a CRD and a custom resource: + +```bash +# Create namespace +kubectl create namespace crd-demo + +# Create the Custom Resource Definition (CRD) +cat < /tmp/pod-images.txt + +# Verify the basic output +cat /tmp/pod-images.txt + +# For the second requirement, we need to handle multi-container pods +# Option 1: Using jsonpath to get comma-separated list of all container images +kubectl get pods -A -o jsonpath="{range .items[*]}{.metadata.name},{.metadata.namespace},{range .spec.containers[*]}{.image}{','}{end}{'\n'}{end}" > /tmp/all-container-images.txt + +# Option 2: Using a more advanced approach with a script +cat <<'EOF' > /tmp/get-pod-images.sh +#!/bin/bash +echo "POD,NAMESPACE,IMAGES" +kubectl get pods -A -o json | jq -r '.items[] | .metadata.name + "," + .metadata.namespace + "," + (.spec.containers | map(.image) | join(","))' +EOF + +chmod +x /tmp/get-pod-images.sh +/tmp/get-pod-images.sh > /tmp/all-container-images.txt + +# Verify the multi-container output +cat /tmp/all-container-images.txt + +# Check that our outputs contain the expected data +grep "multi-container-pod" /tmp/all-container-images.txt +``` + +This solution creates two output files: +1. `/tmp/pod-images.txt` - Shows all pods with their names, namespaces, and primary container images +2. `/tmp/all-container-images.txt` - Shows all pods with all container images, properly handling multi-container pods + +## Question 20: Pod Configuration + +Create a Pod that uses ConfigMaps and Secrets for configuration: + +```bash +# Create namespace +kubectl create namespace pod-configuration + +# Create ConfigMap with database connection settings +kubectl create configmap app-config -n pod-configuration \ + --from-literal=DB_HOST=db.example.com \ + --from-literal=DB_PORT=5432 + +# Verify the ConfigMap was created correctly +kubectl get configmap app-config -n pod-configuration -o yaml + +# Create Secret with API credentials +kubectl create secret generic app-secret -n pod-configuration \ + --from-literal=API_KEY=my-api-key \ + --from-literal=API_SECRET=my-api-secret + +# Verify the Secret was created (note values will be base64 encoded) +kubectl get secret app-secret -n pod-configuration -o yaml + +# Create Pod with environment variables and volume mounts +cat <> /var/log/app.log; sleep 5; done']`\n\nCreate a shared volume named `log-volume` that both containers can access. Mount this volume at `/var/log` in both containers. Ensure the namespace exists before creating the pod.", "concepts": ["multi-container-pods", "volumes", "namespaces"], "verification": [ @@ -77,7 +77,7 @@ { "id": "3", "namespace": "pod-design", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Deployment in the `pod-design` namespace with the following specifications:\n- Name: `frontend`\n- Replicas: `3`\n- Image: `nginx:1.19.0`\n- Labels: `app=frontend, tier=frontend`\n- Pod Labels: same as deployment labels\n\nThen create a service `frontend-svc` that exposes the deployment on port `80`, targeting container port `80`, and is of type `ClusterIP`. Ensure the namespace exists before creating the resources.", "concepts": ["deployments", "services", "labels", "selectors"], "verification": [ @@ -114,7 +114,7 @@ { "id": "4", "namespace": "configuration", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a ConfigMap named `app-config` in the `configuration` namespace \nwith the following data:\n`DB_HOST=mysql`\n`DB_PORT=3306`\n`DB_NAME=myapp`\n\nThen create a Secret named `app-secret` \nwith the following data:\n`DB_USER=admin`\n`DB_PASSWORD=s3cr3t`\n\nFinally, create a Pod named `app-pod` using the `nginx` image that uses both the ConfigMap and Secret. \n\nMount the ConfigMap as environment variables and the Secret as a volume at `/etc/app-secret`. Ensure the namespace exists before creating the resources.", "concepts": ["configmaps", "secrets", "environment-variables", "volumes"], "verification": [ @@ -158,7 +158,7 @@ { "id": "5", "namespace": "observability", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Pod named `probes-pod` in the `observability` namespace using the image `nginx`. Configure the following probes:\n\n1. Liveness probe: HTTP GET request to path `/healthz` on port `80`, with initialDelaySeconds=`10` and periodSeconds=`5`\n\n2. Readiness probe: HTTP GET request to path `/` on port `80`, with initialDelaySeconds=`5` and periodSeconds=`3`\n\nAlso, configure the pod with resource requests of CPU=`100m` and memory=`128Mi`, and resource limits of CPU=`200m` and memory=`256Mi`. \nEnsure the namespace exists before creating the pod.", "concepts": ["probes", "liveness", "readiness", "resource-limits"], "verification": [ @@ -202,7 +202,7 @@ { "id": "6", "namespace": "services", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Deployment named `web-app` in the `services` namespace with 3 replicas using the image `nginx:alpine`. \nLabel the pods with `app=web`.\n\nExpose the deployment with three different services:\n1. A ClusterIP service named `web-svc-cluster` on port `80`\n2. A NodePort service named `web-svc-nodeport` on port `80`, using nodePort `30080`\n3. A LoadBalancer service named `web-svc-lb` on port `80`\n\nEnsure the namespace exists before creating the resources.", "concepts": ["services", "deployments", "clusterip", "nodeport", "loadbalancer"], "verification": [ @@ -246,7 +246,7 @@ { "id": "7", "namespace": "state", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Set up persistent storage for a database application in the `state` namespace:\n\n1. Create a PersistentVolume named `db-pv` with storage capacity of `1Gi`, access mode `ReadWriteOnce`, hostPath type pointing to `/mnt/data`, and reclaim policy `Retain`\n2. Create a PersistentVolumeClaim named `db-pvc` that requests `500Mi` storage with access mode `ReadWriteOnce`\n3. Create a Pod named `db-pod` using the `mysql:5.7` image that mounts the PVC at `/var/lib/mysql`\n4. Set the following environment variables for the pod: \n`MYSQL_ROOT_PASSWORD=rootpassword`, \n`MYSQL_DATABASE=mydb`, \n`MYSQL_USER=myuser`, \n`MYSQL_PASSWORD=mypassword`\n\nEnsure the namespace exists before creating the resources.", "concepts": ["persistent-volumes", "persistent-volume-claims", "volumes", "environment-variables"], "verification": [ @@ -297,7 +297,7 @@ { "id": "8", "namespace": "pod-design", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a CronJob in the `pod-design` namespace with the following specifications:\n\n1. Name: `backup-job`\n2. Schedule: Every 5 minutes\n3. Container image: `busybox`\n4. Command: `['sh', '-c', 'echo Backup started: $(date); sleep 30; echo Backup completed: $(date)']`\n5. Configure the job with a restart policy of `OnFailure`\n6. Set a deadline of `100` seconds for the job to complete\n\nEnsure the namespace exists before creating the resource.", "concepts": ["cronjobs", "jobs", "scheduling"], "verification": [ @@ -334,33 +334,26 @@ { "id": "9", "namespace": "troubleshooting", - "machineHostname": "ckad9988", - "question": "There is a deployment named `broken-deployment` in the `troubleshooting` namespace that is not functioning correctly. The deployment should have `3` replicas of `nginx:1.19` pods, but it`s failing.\n\nFind and fix the issue(s) with the deployment. Possible issues might include:\n- Incorrect image name or tag\n- Resource constraints that can`t be satisfied\n- Configuration problems with the pod template\n- Network policy restrictions\n\nEnsure the deployment functions correctly with 3 replicas running.", + "machineHostname": "ckad9999", + "question": "There is a deployment named `broken-deployment` in the `troubleshooting` namespace that is not functioning correctly. The deployment should have `3` replicas of `nginx:1.19` pods, but it's failing.\n\nFind and fix the issue(s) with the deployment. Possible issues might include:\n- Incorrect image name or tag\n- Resource constraints that can't be satisfied\n- Configuration problems with the pod template\n- Network policy restrictions\n\nEnsure the deployment functions correctly with 3 replicas running.", "concepts": ["troubleshooting", "deployments", "debugging"], "verification": [ { "id": "1", - "description": "Deployment exists", - "verificationScriptFile": "q9_s1_validate_deployment_exists.sh", - "expectedOutput": "0", - "weightage": 1 - }, - { - "id": "2", "description": "Deployment has 3 replicas", "verificationScriptFile": "q9_s2_validate_deployment_replicas.sh", "expectedOutput": "0", "weightage": 2 }, { - "id": "3", + "id": "2", "description": "All pods are in running state", "verificationScriptFile": "q9_s3_validate_pods_running.sh", "expectedOutput": "0", "weightage": 3 }, { - "id": "4", + "id": "3", "description": "Pods are using correct image", "verificationScriptFile": "q9_s4_validate_pods_image.sh", "expectedOutput": "0", @@ -371,7 +364,7 @@ { "id": "10", "namespace": "networking", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a NetworkPolicy in the `networking` namespace that restricts access to the `secure-db` pod with label `app=db` as follows:\n\n1. Allow ingress traffic only from pods with the label `role=frontend` on port `5432`\n2. Allow egress traffic only to pods with the label `role=monitoring` on port `8080`\n3. Deny all other traffic\n\nThen create three pods for testing:\n- A pod named `secure-db` with label `app=db` using image `postgres:12`\n- A pod named `frontend` with label `role=frontend` using image `nginx`\n- A pod named `monitoring` with label `role=monitoring` using image `nginx`\n\nEnsure the namespace exists before creating the resources.", "concepts": ["network-policies", "pods", "labels", "security"], "verification": [ @@ -415,7 +408,7 @@ { "id": "11", "namespace": "security", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Pod named `secure-app` in the `security` namespace with the following security configurations:\n\n1. Run as non-root user (UID: `1000`)\n2. Set security context to drop all capabilities\n3. Set `readOnlyRootFilesystem` to true\n4. Add a security context to the container to run as non-root\n5. Use the `nginx:alpine` image\n\nEnsure the namespace exists before creating the pod.", "concepts": ["security-context", "pod-security", "container-security"], "verification": [ @@ -451,36 +444,36 @@ }, { "id": "12", - "namespace": "storage", - "machineHostname": "ckad9988", - "question": "Create a StatefulSet named `web` in the `storage` namespace with the following specifications:\n\n1. Use image `nginx:stable`\n2. Replicas: `3`\n3. Service name: `web`\n4. Volume claim template with storage class `standard` and size 1Gi\n5. Mount the volume at `/usr/share/nginx/html`\n\nAlso create a headless service named `web` to expose the StatefulSet.\n\nEnsure the namespace exists before creating the resources.", - "concepts": ["statefulsets", "persistent-volume-claims", "headless-services"], + "namespace": "docker-basics", + "machineHostname": "ckad9999", + "question": "Create a simple Docker image and run it:\n\n1. Create a file `/tmp/Dockerfile` with these contents:\n`\nFROM nginx:alpine\nCOPY index.html /usr/share/nginx/html/\nEXPOSE 80\n`\n\n2. Create a file `/tmp/index.html` with this content:\n`\n\n\n\n

    Hello from CKAD Docker Question!

    \n\n\n`\n\n3. Build the Docker image with tag `my-nginx:v1`\n\n4. Run a container from this image with name `my-web` and publish port 80 to 8080 on the host\n\nNote: You'll need to use the Docker command line tools for this task.", + "concepts": ["docker", "images", "containers"], "verification": [ { "id": "1", - "description": "Namespace is created", - "verificationScriptFile": "q12_s1_validate_namespace.sh", + "description": "Dockerfile exists with correct content", + "verificationScriptFile": "q12_s1_validate_dockerfile.sh", "expectedOutput": "0", "weightage": 1 }, { "id": "2", - "description": "StatefulSet is created with correct specifications", - "verificationScriptFile": "q12_s2_validate_statefulset.sh", + "description": "index.html exists with proper content", + "verificationScriptFile": "q12_s2_validate_html.sh", "expectedOutput": "0", - "weightage": 3 + "weightage": 1 }, { "id": "3", - "description": "Headless service is configured correctly", - "verificationScriptFile": "q12_s3_validate_service.sh", + "description": "Docker image is built correctly", + "verificationScriptFile": "q12_s3_validate_image.sh", "expectedOutput": "0", "weightage": 2 }, { "id": "4", - "description": "Volume claim template is configured correctly", - "verificationScriptFile": "q12_s4_validate_volume_claim.sh", + "description": "Container is running properly", + "verificationScriptFile": "q12_s4_validate_container.sh", "expectedOutput": "0", "weightage": 2 } @@ -489,7 +482,7 @@ { "id": "13", "namespace": "jobs", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Job named `data-processor` in the `jobs` namespace with the following specifications:\n\n1. Use image `busybox`\n2. Command: `['sh', '-c', 'for i in $(seq 1 5); do echo Processing item $i; sleep 2; done']`\n3. Set restart policy to `Never`\n4. Set backoff limit to `4`\n5. Set active deadline seconds to `30`\n\nEnsure the namespace exists before creating the job.", "concepts": ["jobs", "restart-policy", "backoff-limit"], "verification": [ @@ -526,7 +519,7 @@ { "id": "14", "namespace": "init-containers", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Pod named `app-with-init` in the `init-containers` namespace with the following specifications:\n\n1. Main container using image `nginx`\n2. Init container using image `busybox` with command: `['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done']`\n3. Create a service named `myservice` using image `nginx`\n4. Share a volume between init container and main container at `/shared`\n\nEnsure the namespace exists before creating the resources.", "concepts": ["init-containers", "services", "shared-volumes"], "verification": [ @@ -562,10 +555,10 @@ }, { "id": "15", - "namespace": "resource-management", - "machineHostname": "ckad9988", - "question": "Create a ResourceQuota named `compute-quota` in the `resource-management` namespace with the following limits:\n\n1. CPU: `4` cores\n2. Memory: `8Gi`\n3. Pods: `10`\n4. Services: `5`\n5. PersistentVolumeClaims: `5`\n\nThen create a LimitRange named `compute-limits` with:\n\n1. Default CPU request: `100m`\n2. Default CPU limit: `200m`\n3. Default memory request: `128Mi`\n4. Default memory limit: `256Mi`\n\nEnsure the namespace exists before creating the resources.", - "concepts": ["resource-quotas", "limit-ranges", "resource-limits"], + "namespace": "helm-basics", + "machineHostname": "ckad9999", + "question": "Perform basic Helm operations:\n\n1. Create a namespace named `helm-basics`\n2. Add the Bitnami repository to Helm with the name `bitnami`\n3. Install the `nginx` chart from the Bitnami repository in the `helm-basics` namespace with the release name `nginx-release`\n4. Save the release notes of the installation to a file at `/tmp/release-notes.txt`", + "concepts": ["helm", "package-management", "kubernetes-applications"], "verification": [ { "id": "1", @@ -576,24 +569,24 @@ }, { "id": "2", - "description": "ResourceQuota is created with correct limits", - "verificationScriptFile": "q15_s2_validate_resource_quota.sh", + "description": "Helm chart is installed correctly", + "verificationScriptFile": "q15_s2_validate_chart_install.sh", "expectedOutput": "0", "weightage": 3 }, { "id": "3", - "description": "LimitRange is created with correct defaults", - "verificationScriptFile": "q15_s3_validate_limit_range.sh", + "description": "Release notes are saved to file", + "verificationScriptFile": "q15_s3_validate_release_notes.sh", "expectedOutput": "0", - "weightage": 3 + "weightage": 2 } ] }, { "id": "16", "namespace": "health-checks", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Pod named `health-check-pod` in the `health-checks` namespace with the following specifications:\n\n1. Use image `nginx`\n\n2. Configure startup probe:\n - HTTP GET on port 80\n - Initial delay: 10s\n - Period: 3s\n - Failure threshold: 3\n\n3. Configure liveness probe:\n - HTTP GET on port 80\n - Initial delay: 15s\n - Period: 5s\n - Failure threshold: 3\n\n4. Configure readiness probe:\n - HTTP GET on port 80\n - Initial delay: 5s\n - Period: 3s\n - Failure threshold: 3\n\nEnsure the namespace exists before creating the pod.", "concepts": ["startup-probes", "liveness-probes", "readiness-probes"], "verification": [ @@ -637,7 +630,7 @@ { "id": "17", "namespace": "pod-lifecycle", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Pod named `lifecycle-pod` in the `pod-lifecycle` namespace with the following specifications:\n\n1. Use image `nginx`\n2. Add postStart hook that creates a file `/usr/share/nginx/html/welcome.txt` with content `Welcome to the pod!`\n3. Add preStop hook that waits for `10` seconds\n4. Set termination grace period to `30` seconds\n\nEnsure the namespace exists before creating the pod.", "concepts": ["lifecycle-hooks", "post-start", "pre-stop", "termination"], "verification": [ @@ -680,10 +673,10 @@ }, { "id": "18", - "namespace": "pod-scheduling", - "machineHostname": "ckad9988", - "question": "Create a Pod named `scheduled-pod` in the `pod-scheduling` namespace with the following specifications:\n\n1. Use image `nginx`\n2. Add node selector to run only on nodes with label `environment=production`\n3. Add toleration for taint `key=production:NoSchedule`\n4. Set priority class to `high-priority`\n\nFirst create a PriorityClass named `high-priority` with value 1000000.\n\nEnsure the namespace exists before creating the resources.", - "concepts": ["node-selectors", "tolerations", "priority-classes"], + "namespace": "crd-demo", + "machineHostname": "ckad9999", + "question": "Create a Custom Resource Definition (CRD) for a simple application:\n\n1. Create a CRD named `applications.training.ckad.io` with:\n - Group: `training.ckad.io`\n - Version: `v1`\n - Kind: `Application`\n - Scope: `Namespaced`\n - Required fields: `spec.image` (string) and `spec.replicas` (integer)\n\n2. After creating the CRD, create a custom resource in the `crd-demo` namespace named `my-app` with:\n - Image: `nginx:1.19.0`\n - Replicas: `3`\n\nEnsure the namespace exists before creating the resources.", + "concepts": ["custom-resource-definitions", "api-extensions", "custom-resources"], "verification": [ { "id": "1", @@ -694,29 +687,29 @@ }, { "id": "2", - "description": "PriorityClass is created correctly", - "verificationScriptFile": "q18_s2_validate_priority_class.sh", + "description": "CRD is created with correct configuration", + "verificationScriptFile": "q18_s2_validate_crd.sh", "expectedOutput": "0", - "weightage": 2 + "weightage": 3 }, { "id": "3", - "description": "Pod has correct node selector", - "verificationScriptFile": "q18_s3_validate_node_selector.sh", + "description": "Custom resource is created with correct name", + "verificationScriptFile": "q18_s3_validate_cr_name.sh", "expectedOutput": "0", "weightage": 2 }, { "id": "4", - "description": "Pod has correct toleration", - "verificationScriptFile": "q18_s4_validate_toleration.sh", + "description": "Custom resource has correct image field", + "verificationScriptFile": "q18_s4_validate_cr_image.sh", "expectedOutput": "0", "weightage": 2 }, { "id": "5", - "description": "Pod uses correct priority class", - "verificationScriptFile": "q18_s5_validate_priority.sh", + "description": "Custom resource has correct replicas field", + "verificationScriptFile": "q18_s5_validate_cr_replicas.sh", "expectedOutput": "0", "weightage": 2 } @@ -724,52 +717,31 @@ }, { "id": "19", - "namespace": "pod-networking", - "machineHostname": "ckad9988", - "question": "Create a Pod named `network-pod` in the `pod-networking` namespace with the following specifications:\n\n1. Use image `nginx`\n2. Set hostname to `custom-hostname`\n3. Set subdomain to `custom-subdomain`\n4. Configure DNS policy to `ClusterFirstWithHostNet`\n5. Enable host networking\n\nAlso create a headless service named `network-service` to expose the pod.\n\nEnsure the namespace exists before creating the resources.", - "concepts": ["pod-networking", "dns-policy", "host-networking"], + "namespace": "custom-columns-demo", + "machineHostname": "ckad9999", + "question": "Use kubectl custom columns to extract and display pod information:\n\n1. There are several pods and deployments running in the `custom-columns-demo` namespace\n2. Create a custom column output showing all pods from all namespaces, including their names, namespaces, and container images\n3. Save this output to `/tmp/pod-images.txt`\n4. Create another output showing multi-container pod details with pod name, namespace, and all container images as comma-separated values\n5. Save this second output to `/tmp/all-container-images.txt`\n\nEnsure the namespace exists before starting your work.", + "concepts": ["kubectl", "custom-columns", "jsonpath", "output-formatting"], "verification": [ - { - "id": "1", - "description": "Namespace is created", - "verificationScriptFile": "q19_s1_validate_namespace.sh", - "expectedOutput": "0", - "weightage": 1 - }, { "id": "2", - "description": "Pod is created with correct name and image", - "verificationScriptFile": "q19_s2_validate_pod.sh", + "description": "pod-images.txt file exists and has correct format", + "verificationScriptFile": "q19_s2_validate_basic_output.sh", "expectedOutput": "0", - "weightage": 1 + "weightage": 2 }, { "id": "3", - "description": "Pod has correct hostname and subdomain", - "verificationScriptFile": "q19_s3_validate_hostname.sh", + "description": "all-container-images.txt file exists with multi-container details", + "verificationScriptFile": "q19_s3_validate_advanced_output.sh", "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "4", - "description": "Pod has correct DNS policy and host networking", - "verificationScriptFile": "q19_s4_validate_networking.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "5", - "description": "Headless service is configured correctly", - "verificationScriptFile": "q19_s5_validate_service.sh", - "expectedOutput": "0", - "weightage": 2 + "weightage": 3 } ] }, { "id": "20", "namespace": "pod-configuration", - "machineHostname": "ckad9988", + "machineHostname": "ckad9999", "question": "Create a Pod named `config-pod` in the `pod-configuration` namespace with the following specifications:\n\n1. Use image `nginx`\n2. Add environment variables:\n - `APP_ENV=production`\n - `DEBUG=false`\n3. Add environment variables from ConfigMap `app-config` with keys:\n - `DB_HOST`\n - `DB_PORT`\n4. Mount ConfigMap `app-config` as a volume at `/etc/app-config`\n5. Add environment variables from Secret `app-secret` with keys:\n - `API_KEY`\n - `API_SECRET`\n\nFirst create the ConfigMap and Secret with the specified data.\n\nEnsure the namespace exists before creating the resources.", "concepts": ["environment-variables", "configmaps", "secrets", "volumes"], "verification": [ diff --git a/facilitator/assets/exams/ckad/002/scripts/setup/q12_setup.sh b/facilitator/assets/exams/ckad/002/scripts/setup/q12_setup.sh index 4a9c715..3820db6 100755 --- a/facilitator/assets/exams/ckad/002/scripts/setup/q12_setup.sh +++ b/facilitator/assets/exams/ckad/002/scripts/setup/q12_setup.sh @@ -1,12 +1,20 @@ #!/bin/bash -# Delete the storage namespace if it exists -echo "Setting up environment for Question 12 (StatefulSet)..." -kubectl delete namespace storage --ignore-not-found=true +# Make sure Docker is available +which docker > /dev/null 2>&1 +if [[ $? -ne 0 ]]; then + echo "Docker is not available on this system" + exit 1 +fi -# Wait for deletion to complete -sleep 2 +# Create directory for working files if it doesn't exist +mkdir -p /tmp -# Confirm environment is ready -echo "Environment ready for Question 12" +# Clean up any existing resources that might conflict +docker stop my-web > /dev/null 2>&1 +docker rm my-web > /dev/null 2>&1 +docker rmi my-nginx:v1 > /dev/null 2>&1 +rm -f /tmp/Dockerfile /tmp/index.html > /dev/null 2>&1 + +echo "Setup complete for Question 12" exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/setup/q15_setup.sh b/facilitator/assets/exams/ckad/002/scripts/setup/q15_setup.sh index 62a7196..97e695b 100755 --- a/facilitator/assets/exams/ckad/002/scripts/setup/q15_setup.sh +++ b/facilitator/assets/exams/ckad/002/scripts/setup/q15_setup.sh @@ -1,12 +1,14 @@ #!/bin/bash -# Delete the resource-management namespace if it exists -echo "Setting up environment for Question 15 (Resource Quotas)..." -kubectl delete namespace resource-management --ignore-not-found=true +# Check if Helm is installed +if ! command -v helm &> /dev/null; then + echo "Helm is not available, skipping setup" + exit 0 +fi -# Wait for deletion to complete -sleep 2 +# Clean up any existing resources +kubectl delete namespace helm-basics --ignore-not-found=true -# Confirm environment is ready -echo "Environment ready for Question 15" + +echo "Setup complete for Question 15" exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/setup/q18_setup.sh b/facilitator/assets/exams/ckad/002/scripts/setup/q18_setup.sh index ede3e02..dea1083 100755 --- a/facilitator/assets/exams/ckad/002/scripts/setup/q18_setup.sh +++ b/facilitator/assets/exams/ckad/002/scripts/setup/q18_setup.sh @@ -1,15 +1,3 @@ #!/bin/bash - -# Delete the pod-scheduling namespace if it exists -echo "Setting up environment for Question 18 (Pod Scheduling)..." -kubectl delete namespace pod-scheduling --ignore-not-found=true - -# Delete the high-priority PriorityClass if it exists -kubectl delete priorityclass high-priority --ignore-not-found=true - -# Wait for deletion to complete -sleep 2 - -# Confirm environment is ready -echo "Environment ready for Question 18" +echo "Setup complete for Question 18" exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/setup/q19_setup.sh b/facilitator/assets/exams/ckad/002/scripts/setup/q19_setup.sh index af4736b..c994b49 100755 --- a/facilitator/assets/exams/ckad/002/scripts/setup/q19_setup.sh +++ b/facilitator/assets/exams/ckad/002/scripts/setup/q19_setup.sh @@ -1,12 +1,68 @@ #!/bin/bash -# Delete the pod-networking namespace if it exists -echo "Setting up environment for Question 19 (Pod Networking)..." -kubectl delete namespace pod-networking --ignore-not-found=true +# Create namespace and sample resources for custom columns demo +kubectl create namespace custom-columns-demo > /dev/null 2>&1 -# Wait for deletion to complete -sleep 2 +# Create sample pods and deployments with different images +kubectl apply -f - < /dev/null 2>&1 +apiVersion: v1 +kind: Namespace +metadata: + name: custom-columns-demo +--- +apiVersion: v1 +kind: Pod +metadata: + name: nginx-pod + namespace: custom-columns-demo +spec: + containers: + - name: nginx + image: nginx:1.19 +--- +apiVersion: v1 +kind: Pod +metadata: + name: busybox-pod + namespace: custom-columns-demo +spec: + containers: + - name: busybox + image: busybox:latest + command: ["sleep", "3600"] +--- +apiVersion: v1 +kind: Pod +metadata: + name: multi-container-pod + namespace: custom-columns-demo +spec: + containers: + - name: nginx + image: nginx:alpine + - name: sidecar + image: busybox:1.34 + command: ["sleep", "3600"] +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redis-deployment + namespace: custom-columns-demo +spec: + replicas: 2 + selector: + matchLabels: + app: redis + template: + metadata: + labels: + app: redis + spec: + containers: + - name: redis + image: redis:alpine +EOF -# Confirm environment is ready -echo "Environment ready for Question 19" +echo "Setup complete for Question 19" exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/setup/q9_setup.sh b/facilitator/assets/exams/ckad/002/scripts/setup/q9_setup.sh index bb5082e..6deccd4 100755 --- a/facilitator/assets/exams/ckad/002/scripts/setup/q9_setup.sh +++ b/facilitator/assets/exams/ckad/002/scripts/setup/q9_setup.sh @@ -11,7 +11,7 @@ metadata: name: broken-deployment namespace: troubleshooting spec: - replicas: 3 + replicas: 1 selector: matchLabels: app: nginx diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_dockerfile.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_dockerfile.sh new file mode 100644 index 0000000..35c2c94 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_dockerfile.sh @@ -0,0 +1,26 @@ +#!/bin/bash + +# Check if the Dockerfile exists +if [[ ! -f "/tmp/Dockerfile" ]]; then + echo "❌ File '/tmp/Dockerfile' not found" + exit 1 +fi + +# Check if the Dockerfile contains necessary elements +if ! grep -q "FROM.*nginx:alpine" /tmp/Dockerfile; then + echo "❌ Dockerfile should use 'nginx:alpine' as base image" + exit 1 +fi + +if ! grep -q "COPY.*index.html" /tmp/Dockerfile; then + echo "❌ Dockerfile should copy 'index.html' file" + exit 1 +fi + +if ! grep -q "EXPOSE.*80" /tmp/Dockerfile; then + echo "❌ Dockerfile should expose port 80" + exit 1 +fi + +echo "✅ Dockerfile exists with correct content" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_namespace.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_namespace.sh deleted file mode 100755 index c99f57d..0000000 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s1_validate_namespace.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/bash - -# Validate that the storage namespace exists -NS=$(kubectl get namespace storage -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$NS" == "storage" ]]; then - # Namespace exists - exit 0 -else - # Namespace does not exist - echo "Namespace 'storage' does not exist" - exit 1 -fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_html.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_html.sh new file mode 100644 index 0000000..920ced3 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_html.sh @@ -0,0 +1,32 @@ +#!/bin/bash + +# Check if the index.html exists +if [[ ! -f "/tmp/index.html" ]]; then + echo "❌ File '/tmp/index.html' not found" + exit 1 +fi + +# Check if the HTML contains necessary content +if ! grep -q "Hello from CKAD Docker Question" /tmp/index.html; then + echo "❌ HTML file should contain 'Hello from CKAD Docker Question'" + exit 1 +fi + +# Check basic HTML structure +if ! grep -q "" /tmp/index.html; then + echo "❌ HTML file should have DOCTYPE declaration" + exit 1 +fi + +if ! grep -q "" /tmp/index.html; then + echo "❌ HTML file should contain tag" + exit 1 +fi + +if ! grep -q "" /tmp/index.html; then + echo "❌ HTML file should contain tag" + exit 1 +fi + +echo "✅ index.html exists with correct content" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_statefulset.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_statefulset.sh deleted file mode 100755 index 168d2e5..0000000 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s2_validate_statefulset.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -# Validate that the web StatefulSet exists -STATEFULSET=$(kubectl get statefulset web -n storage -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$STATEFULSET" == "web" ]]; then - # StatefulSet exists, now check the specs - - # Check image - IMAGE=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null) - - # Check replicas - REPLICAS=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.replicas}' 2>/dev/null) - - # Check service name - SERVICE_NAME=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.serviceName}' 2>/dev/null) - - if [[ "$IMAGE" == "nginx:stable" && "$REPLICAS" == "3" && "$SERVICE_NAME" == "web" ]]; then - # All specifications are correct - exit 0 - else - echo "StatefulSet 'web' does not have correct specifications." - echo "Found image: $IMAGE (expected: nginx:stable)" - echo "Found replicas: $REPLICAS (expected: 3)" - echo "Found service name: $SERVICE_NAME (expected: web)" - exit 1 - fi -else - # StatefulSet does not exist - echo "StatefulSet 'web' does not exist in the 'storage' namespace" - exit 1 -fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_image.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_image.sh new file mode 100644 index 0000000..e2993e6 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_image.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +# Check if the Docker image exists +docker image inspect my-nginx:v1 &> /dev/null +if [[ $? -ne 0 ]]; then + echo "❌ Docker image 'my-nginx:v1' not found" + exit 1 +fi + +#Docker image is built correctly +echo "✅ Docker image 'my-nginx:v1' has been built correctly with all required elements" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_service.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_service.sh deleted file mode 100755 index 9d63311..0000000 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s3_validate_service.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/bash - -# Validate that the web headless service exists -SERVICE=$(kubectl get service web -n storage -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$SERVICE" == "web" ]]; then - # Service exists, now check if it's a headless service - CLUSTER_IP=$(kubectl get service web -n storage -o jsonpath='{.spec.clusterIP}' 2>/dev/null) - - if [[ "$CLUSTER_IP" == "None" ]]; then - # This is a headless service - - # Check selector to make sure it matches the StatefulSet - SELECTOR=$(kubectl get service web -n storage -o jsonpath='{.spec.selector.app}' 2>/dev/null) - - if [[ "$SELECTOR" != "" ]]; then - # Selector exists - exit 0 - else - echo "Headless service 'web' does not have a selector" - exit 1 - fi - else - echo "Service 'web' is not a headless service. ClusterIP: $CLUSTER_IP" - exit 1 - fi -else - # Service does not exist - echo "Service 'web' does not exist in the 'storage' namespace" - exit 1 -fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_container.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_container.sh new file mode 100644 index 0000000..3a9e267 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_container.sh @@ -0,0 +1,32 @@ +#!/bin/bash + +# Check if the container exists +docker container inspect my-web > /dev/null 2>&1 +if [[ $? -ne 0 ]]; then + echo "❌ Container 'my-web' not found" + exit 1 +fi + +# Check if the container is running +CONTAINER_STATE=$(docker container inspect my-web --format '{{.State.Status}}') +if [[ "$CONTAINER_STATE" != "running" ]]; then + echo "❌ Container 'my-web' is not running (current state: $CONTAINER_STATE)" + exit 1 +fi + +# Check if the container is using the correct image +CONTAINER_IMAGE=$(docker container inspect my-web --format '{{.Config.Image}}') +if [[ "$CONTAINER_IMAGE" != "my-nginx:v1" ]]; then + echo "❌ Container should use 'my-nginx:v1' image (current image: $CONTAINER_IMAGE)" + exit 1 +fi + +# Check if port 80 is published to 8080 +PORT_MAPPING=$(docker container inspect my-web --format '{{json .HostConfig.PortBindings}}' | grep -o "8080") +if [[ -z "$PORT_MAPPING" ]]; then + echo "❌ Container should publish port 80 to port 8080 on the host" + exit 1 +fi + +echo "✅ Container 'my-web' is running properly" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_volume_claim.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_volume_claim.sh deleted file mode 100755 index 2e475c0..0000000 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q12_s4_validate_volume_claim.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -# Validate that the StatefulSet has a volume claim template -VCT=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.volumeClaimTemplates[0].metadata.name}' 2>/dev/null) - -if [[ "$VCT" != "" ]]; then - # Volume claim template exists, check storage class and size - - # Check storage class - STORAGE_CLASS=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.volumeClaimTemplates[0].spec.storageClassName}' 2>/dev/null) - - # Check storage size - STORAGE_SIZE=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.volumeClaimTemplates[0].spec.resources.requests.storage}' 2>/dev/null) - - # Check mount path - MOUNT_PATH=$(kubectl get statefulset web -n storage -o jsonpath='{.spec.template.spec.containers[0].volumeMounts[0].mountPath}' 2>/dev/null) - - if [[ "$STORAGE_CLASS" == "standard" && "$STORAGE_SIZE" == "1Gi" && "$MOUNT_PATH" == "/usr/share/nginx/html" ]]; then - # Volume claim template is configured correctly - exit 0 - else - echo "Volume claim template is not configured correctly." - echo "Found storage class: $STORAGE_CLASS (expected: standard)" - echo "Found storage size: $STORAGE_SIZE (expected: 1Gi)" - echo "Found mount path: $MOUNT_PATH (expected: /usr/share/nginx/html)" - exit 1 - fi -else - # No volume claim template - echo "StatefulSet 'web' does not have a volume claim template" - exit 1 -fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q13_s2_validate_job.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q13_s2_validate_job.sh index ccd912e..ca313fa 100755 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q13_s2_validate_job.sh +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q13_s2_validate_job.sh @@ -4,25 +4,26 @@ JOB=$(kubectl get job data-processor -n jobs -o jsonpath='{.metadata.name}' 2>/dev/null) if [[ "$JOB" == "data-processor" ]]; then - # Job exists, now check the specs - + echo "✅ Job 'data-processor' exists in namespace 'jobs'." + # Check image IMAGE=$(kubectl get job data-processor -n jobs -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null) - - # Check command - COMMAND=$(kubectl get job data-processor -n jobs -o jsonpath='{.spec.template.spec.containers[0].command}' 2>/dev/null) - - if [[ "$IMAGE" == "busybox" && "$COMMAND" == *"for i in"* && "$COMMAND" == *"seq 1 5"* ]]; then - # Job has correct image and command + + # Get full command string + COMMAND=$(kubectl get job data-processor -n jobs -o jsonpath='{.spec.template.spec.containers[0].command[*]}' 2>/dev/null) + + # Use relaxed matching instead of strict string comparison + if [[ "$IMAGE" == "busybox" && "$COMMAND" == *"Processing item"* && "$COMMAND" == *"sleep 2"* ]]; then + echo "✅ Job has the correct image and command logic." exit 0 else - echo "Job 'data-processor' does not have correct specifications." - echo "Found image: $IMAGE (expected: busybox)" - echo "Found command: $COMMAND (expected: command that loops from 1 to 5)" + echo "❌ Job 'data-processor' does not have correct specifications." + echo " ➤ Found image: $IMAGE (expected: busybox)" + echo " ➤ Found command: $COMMAND" + echo " ➤ Expected command to include: 'Processing item' and 'sleep 2'" exit 1 fi else - # Job does not exist - echo "Job 'data-processor' does not exist in the 'jobs' namespace" + echo "❌ Job 'data-processor' does not exist in the 'jobs' namespace." exit 1 -fi \ No newline at end of file +fi diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q15_s1_validate_namespace.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s1_validate_namespace.sh index 84c13fb..1d39641 100755 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q15_s1_validate_namespace.sh +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s1_validate_namespace.sh @@ -1,13 +1,11 @@ #!/bin/bash -# Validate that the resource-management namespace exists -NS=$(kubectl get namespace resource-management -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$NS" == "resource-management" ]]; then - # Namespace exists - exit 0 +# Check if the namespace exists +kubectl get namespace helm-basics &> /dev/null +if [[ $? -eq 0 ]]; then + echo "✅ Namespace 'helm-basics' exists" + exit 0 else - # Namespace does not exist - echo "Namespace 'resource-management' does not exist" - exit 1 + echo "❌ Namespace 'helm-basics' not found" + exit 1 fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_chart_install.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_chart_install.sh new file mode 100644 index 0000000..5d39d60 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_chart_install.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +# Check if Helm is installed +if ! command -v helm &> /dev/null; then + echo "❌ Helm is not available on this system" + exit 1 +fi + +# Check if Bitnami repository is added +REPO_EXISTS=$(helm repo list | grep bitnami | wc -l) +if [[ "$REPO_EXISTS" -eq 0 ]]; then + echo "❌ Bitnami repository is not added to Helm" + exit 1 +fi + +# Check if the nginx chart is installed +RELEASE_EXISTS=$(helm list -n helm-basics | grep nginx-release | wc -l) +if [[ "$RELEASE_EXISTS" -eq 0 ]]; then + echo "❌ nginx chart is not installed in the 'helm-basics' namespace" + exit 1 +fi + +# Check if pods related to the release are running +PODS_RUNNING=$(kubectl get pods -n helm-basics -l app.kubernetes.io/instance=nginx-release | grep Running | wc -l) +if [[ "$PODS_RUNNING" -eq 0 ]]; then + echo "❌ No pods from the nginx release are running" + exit 1 +fi + +echo "✅ Helm chart 'nginx' is installed correctly in the 'helm-basics' namespace" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_values.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_values.sh new file mode 100644 index 0000000..2678d13 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s2_validate_values.sh @@ -0,0 +1,70 @@ +#!/bin/bash + +# Check if the fixed values.yaml file exists +if [[ ! -f "/tmp/fixed-chart/values.yaml" ]]; then + echo "❌ File '/tmp/fixed-chart/values.yaml' not found" + exit 1 +fi + +# Check if the values.yaml file has correct content +VALUES_CONTENT=$(cat /tmp/fixed-chart/values.yaml) + +# Check replicaCount +if ! grep -q "replicaCount: 2" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'replicaCount: 2'" + exit 1 +fi + +# Check image section +if ! grep -q "image:" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'image:' section" + exit 1 +fi + +if ! grep -q "repository: nginx" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'repository: nginx' under image section" + exit 1 +fi + +if ! grep -q "tag: 1.19.0" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'tag: 1.19.0' under image section" + exit 1 +fi + +# Check service section +if ! grep -q "service:" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'service:' section" + exit 1 +fi + +if ! grep -q "type: ClusterIP" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'type: ClusterIP' under service section" + exit 1 +fi + +# Check resources section +if ! grep -q "resources:" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'resources:' section" + exit 1 +fi + +if ! grep -q "limits:" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'limits:' under resources section" + exit 1 +fi + +if ! grep -q "cpu: 100m" /tmp/fixed-chart/values.yaml; then + echo "❌ values.yaml should have 'cpu: 100m' under limits section" + exit 1 +fi + +# Check for correct indentation +# This is a simple check - in a real exam we would need more comprehensive validation +INDENT_CHECK=$(grep -E '^ {2}[a-z]+:' /tmp/fixed-chart/values.yaml | wc -l) +if [[ "$INDENT_CHECK" -lt 3 ]]; then + echo "❌ values.yaml does not have proper indentation" + exit 1 +fi + +echo "✅ values.yaml is properly formatted with correct content" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_chart.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_chart.sh new file mode 100644 index 0000000..f352dde --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_chart.sh @@ -0,0 +1,61 @@ +#!/bin/bash + +# Check if the fixed chart.yaml file exists +if [[ ! -f "/tmp/fixed-chart/chart.yaml" ]]; then + echo "❌ File '/tmp/fixed-chart/chart.yaml' not found" + exit 1 +fi + +# Check if the chart.yaml file has correct content +CHART_CONTENT=$(cat /tmp/fixed-chart/chart.yaml) + +# Check basic chart properties +if ! grep -q "apiVersion: v2" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'apiVersion: v2'" + exit 1 +fi + +if ! grep -q "name: example-app" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'name: example-app'" + exit 1 +fi + +if ! grep -q "description: A simple example Helm chart" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have a description" + exit 1 +fi + +if ! grep -q "type: application" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'type: application'" + exit 1 +fi + +if ! grep -q "version: 0.1.0" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'version: 0.1.0'" + exit 1 +fi + +# Check for dependencies section +if ! grep -q "dependencies:" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'dependencies:' section" + exit 1 +fi + +# Check for nginx-ingress dependency +if ! grep -q "name: nginx-ingress" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'name: nginx-ingress' under dependencies" + exit 1 +fi + +if ! grep -q "version: \"1.41.0\"" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should have 'version: \"1.41.0\"' for nginx-ingress dependency" + exit 1 +fi + +if ! grep -q "repository: \"https://charts.bitnami.com/bitnami\"" /tmp/fixed-chart/chart.yaml; then + echo "❌ chart.yaml should specify Bitnami repository for nginx-ingress" + exit 1 +fi + +echo "✅ chart.yaml is properly formatted with correct dependencies" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_release_notes.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_release_notes.sh new file mode 100644 index 0000000..fd9c403 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q15_s3_validate_release_notes.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# Check if the release notes file exists +if [[ ! -f "/tmp/release-notes.txt" ]]; then + echo "❌ File '/tmp/release-notes.txt' not found" + exit 1 +fi + +# Check if the file has content +if [[ ! -s "/tmp/release-notes.txt" ]]; then + echo "❌ Release notes file is empty" + exit 1 +fi + +# Check if the file actually contains release notes +if ! grep -q "RELEASE NOTES" /tmp/release-notes.txt && ! grep -q "Bitnami" /tmp/release-notes.txt && ! grep -q "nginx" /tmp/release-notes.txt; then + echo "❌ File does not appear to contain Helm release notes" + exit 1 +fi + +echo "✅ Release notes are saved correctly to /tmp/release-notes.txt" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q17_s5_validate_grace_period.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q17_s5_validate_grace_period.sh index 8619f7c..7bfee94 100755 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q17_s5_validate_grace_period.sh +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q17_s5_validate_grace_period.sh @@ -7,8 +7,8 @@ if [[ "$POD" == "lifecycle-pod" ]]; then # Pod exists, now check if it has a termination grace period GRACE_PERIOD=$(kubectl get pod lifecycle-pod -n pod-lifecycle -o jsonpath='{.spec.terminationGracePeriodSeconds}' 2>/dev/null) - if [[ "$GRACE_PERIOD" == "45" ]]; then - # Grace period is correctly set to 45 seconds + if [[ "$GRACE_PERIOD" == "30" ]]; then + # Grace period is correctly set to 30 seconds exit 0 elif [[ "$GRACE_PERIOD" == "" ]]; then echo "Pod 'lifecycle-pod' does not have a termination grace period specified (using default of 30 seconds)" diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q18_s1_validate_namespace.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s1_validate_namespace.sh index de05ba7..37c72e6 100755 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q18_s1_validate_namespace.sh +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s1_validate_namespace.sh @@ -1,13 +1,11 @@ #!/bin/bash -# Validate that the pod-scheduling namespace exists -NS=$(kubectl get namespace pod-scheduling -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$NS" == "pod-scheduling" ]]; then - # Namespace exists - exit 0 +# Check if the namespace exists +kubectl get namespace crd-demo &> /dev/null +if [[ $? -eq 0 ]]; then + echo "✅ Namespace 'crd-demo' exists" + exit 0 else - # Namespace does not exist - echo "Namespace 'pod-scheduling' does not exist" - exit 1 + echo "❌ Namespace 'crd-demo' not found" + exit 1 fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q18_s2_validate_crd.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s2_validate_crd.sh new file mode 100644 index 0000000..d8fe022 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s2_validate_crd.sh @@ -0,0 +1,40 @@ +#!/bin/bash + +# Check if the CRD exists +kubectl get crd applications.training.ckad.io &> /dev/null +if [[ $? -ne 0 ]]; then + echo "❌ CRD 'applications.training.ckad.io' not found" + exit 1 +fi + +# Check group +GROUP=$(kubectl get crd applications.training.ckad.io -o jsonpath='{.spec.group}') +if [[ "$GROUP" != "training.ckad.io" ]]; then + echo "❌ CRD has incorrect group. Expected 'training.ckad.io', got '$GROUP'" + exit 1 +fi + +# Check kind +KIND=$(kubectl get crd applications.training.ckad.io -o jsonpath='{.spec.names.kind}') +if [[ "$KIND" != "Application" ]]; then + echo "❌ CRD has incorrect kind. Expected 'Application', got '$KIND'" + exit 1 +fi + +# Check scope +SCOPE=$(kubectl get crd applications.training.ckad.io -o jsonpath='{.spec.scope}') +if [[ "$SCOPE" != "Namespaced" ]]; then + echo "❌ CRD has incorrect scope. Expected 'Namespaced', got '$SCOPE'" + exit 1 +fi + +# Check for required fields in schema +# This is a simple check - in a real scenario we would do more validation +SCHEMA=$(kubectl get crd applications.training.ckad.io -o jsonpath='{.spec.versions[*].schema.openAPIV3Schema.properties.spec.properties}') +if [[ "$SCHEMA" != *"image"* || "$SCHEMA" != *"replicas"* ]]; then + echo "❌ CRD schema should define 'image' and 'replicas' fields" + exit 1 +fi + +echo "✅ CRD 'applications.training.ckad.io' is configured correctly" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q18_s3_validate_cr_name.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s3_validate_cr_name.sh new file mode 100644 index 0000000..eccef48 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s3_validate_cr_name.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +# Check if the CRD exists first (prerequisite) +kubectl get crd applications.training.ckad.io &> /dev/null +if [[ $? -ne 0 ]]; then + echo "❌ CRD 'applications.training.ckad.io' not found. Cannot validate custom resources." + exit 1 +fi + +# Check if the custom resource exists +kubectl get application my-app -n crd-demo &> /dev/null +if [[ $? -ne 0 ]]; then + echo "❌ Custom resource 'my-app' not found in namespace 'crd-demo'" + exit 1 +fi + +echo "✅ Custom resource 'my-app' exists with correct name" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q18_s4_validate_cr_image.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s4_validate_cr_image.sh new file mode 100644 index 0000000..68d3a58 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s4_validate_cr_image.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +# Check if the custom resource exists first +kubectl get application my-app -n crd-demo &> /dev/null +if [[ $? -ne 0 ]]; then + echo "❌ Custom resource 'my-app' not found in namespace 'crd-demo'" + exit 1 +fi + +# Check if the image field is set correctly +IMAGE=$(kubectl get application my-app -n crd-demo -o jsonpath='{.spec.image}' 2>/dev/null) +if [[ "$IMAGE" != "nginx:1.19.0" ]]; then + echo "❌ Custom resource should have spec.image='nginx:1.19.0'. Current value: '$IMAGE'" + exit 1 +fi + +echo "✅ Custom resource has correct image field" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q18_s5_validate_cr_replicas.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s5_validate_cr_replicas.sh new file mode 100644 index 0000000..bf18b61 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q18_s5_validate_cr_replicas.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +# Check if the custom resource exists first +kubectl get application my-app -n crd-demo &> /dev/null +if [[ $? -ne 0 ]]; then + echo "❌ Custom resource 'my-app' not found in namespace 'crd-demo'" + exit 1 +fi + +# Check if the replicas field is set correctly +REPLICAS=$(kubectl get application my-app -n crd-demo -o jsonpath='{.spec.replicas}' 2>/dev/null) +if [[ "$REPLICAS" != "3" ]]; then + echo "❌ Custom resource should have spec.replicas=3. Current value: '$REPLICAS'" + exit 1 +fi + +echo "✅ Custom resource has correct replicas field" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q19_s1_validate_namespace.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q19_s1_validate_namespace.sh index 89a8b43..6418bf7 100755 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q19_s1_validate_namespace.sh +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q19_s1_validate_namespace.sh @@ -1,13 +1,11 @@ #!/bin/bash -# Validate that the pod-networking namespace exists -NS=$(kubectl get namespace pod-networking -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$NS" == "pod-networking" ]]; then - # Namespace exists - exit 0 +# Check if the namespace exists +kubectl get namespace custom-columns-demo &> /dev/null +if [[ $? -eq 0 ]]; then + echo "✅ Namespace 'custom-columns-demo' exists" + exit 0 else - # Namespace does not exist - echo "Namespace 'pod-networking' does not exist" - exit 1 + echo "❌ Namespace 'custom-columns-demo' not found" + exit 1 fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q19_s2_validate_basic_output.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q19_s2_validate_basic_output.sh new file mode 100644 index 0000000..1f855d7 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q19_s2_validate_basic_output.sh @@ -0,0 +1,41 @@ +#!/bin/bash + +# Check if the output file exists +if [[ ! -f "/tmp/pod-images.txt" ]]; then + echo "❌ File '/tmp/pod-images.txt' not found" + exit 1 +fi + +# Check if the file has content +if [[ ! -s "/tmp/pod-images.txt" ]]; then + echo "❌ File '/tmp/pod-images.txt' is empty" + exit 1 +fi + +# Check if the file contains custom column headers +if ! grep -q "POD.*NAMESPACE.*IMAGE" /tmp/pod-images.txt; then + echo "❌ File should contain column headers for POD, NAMESPACE, and IMAGE" + exit 1 +fi + +# Check if our sample pods are listed +if ! grep -q "nginx-pod.*custom-columns-demo.*nginx:1.19" /tmp/pod-images.txt; then + echo "❌ File should contain nginx-pod from custom-columns-demo namespace with image nginx:1.19" + exit 1 +fi + +if ! grep -q "busybox-pod.*custom-columns-demo.*busybox" /tmp/pod-images.txt; then + echo "❌ File should contain busybox-pod from custom-columns-demo namespace" + exit 1 +fi + +# Check if the file contains pods from other namespaces +# This is a simplistic check - in a real scenario we'd verify actual pods from other namespaces +NAMESPACE_COUNT=$(grep -v "custom-columns-demo" /tmp/pod-images.txt | grep -v "NAMESPACE" | wc -l) +if [[ "$NAMESPACE_COUNT" -eq 0 ]]; then + echo "❌ File should contain pods from namespaces other than custom-columns-demo" + exit 1 +fi + +echo "✅ pod-images.txt file exists with correct custom column format" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q19_s3_validate_advanced_output.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q19_s3_validate_advanced_output.sh new file mode 100644 index 0000000..28637dd --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q19_s3_validate_advanced_output.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +# Check if the output file exists +if [[ ! -f "/tmp/all-container-images.txt" ]]; then + echo "❌ File '/tmp/all-container-images.txt' not found" + exit 1 +fi + +# Check if the file has content +if [[ ! -s "/tmp/all-container-images.txt" ]]; then + echo "❌ File '/tmp/all-container-images.txt' is empty" + exit 1 +fi + +# Check if the file contains multi-container pod information +# Our setup included a pod named multi-container-pod with nginx and busybox containers +MULTI_CONTAINER_LINE=$(grep "multi-container-pod" /tmp/all-container-images.txt) +if [[ -z "$MULTI_CONTAINER_LINE" ]]; then + echo "❌ File should contain information about multi-container-pod" + exit 1 +fi + +# Check if both container images are listed for the multi-container pod +# This could be done in several ways depending on the output format chosen by the user +if echo "$MULTI_CONTAINER_LINE" | grep -q "nginx:alpine" && echo "$MULTI_CONTAINER_LINE" | grep -q "busybox:1.34"; then + # Both images are found on the same line + echo "✅ File correctly shows both container images for multi-container-pod" +elif [[ $(grep "multi-container-pod.*nginx:alpine" /tmp/all-container-images.txt | wc -l) -gt 0 && $(grep "multi-container-pod.*busybox:1.34" /tmp/all-container-images.txt | wc -l) -gt 0 ]]; then + # Images might be on separate lines + echo "✅ File contains both container images for multi-container-pod" +else + echo "❌ File should list both nginx:alpine and busybox:1.34 images for multi-container-pod" + exit 1 +fi + +# Check if the file format includes the pod name and namespace +# This is a simplistic check - there are multiple valid formats +if grep -q "POD.*NAMESPACE.*IMAGES" /tmp/all-container-images.txt || grep -E -q ".*,.*,.*" /tmp/all-container-images.txt; then + echo "✅ File format includes pod name, namespace, and images" +else + echo "❌ File should include pod name, namespace, and images information" + exit 1 +fi + +echo "✅ all-container-images.txt contains multi-container pod details" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q20_s1_validate_namespace.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s1_validate_namespace.sh index 8f2c115..1e3ddab 100755 --- a/facilitator/assets/exams/ckad/002/scripts/validation/q20_s1_validate_namespace.sh +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s1_validate_namespace.sh @@ -1,13 +1,11 @@ #!/bin/bash -# Validate that the network-policy namespace exists -NS=$(kubectl get namespace network-policy -o jsonpath='{.metadata.name}' 2>/dev/null) - -if [[ "$NS" == "network-policy" ]]; then - # Namespace exists - exit 0 +# Check if namespace exists +NS_EXISTS=$(kubectl get namespace pod-configuration --no-headers --output=name 2>/dev/null | wc -l) +if [[ "$NS_EXISTS" -eq 1 ]]; then + echo "✅ Namespace 'pod-configuration' exists" + exit 0 else - # Namespace does not exist - echo "Namespace 'network-policy' does not exist" - exit 1 + echo "❌ Namespace 'pod-configuration' not found" + exit 1 fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q20_s2_validate_configmap.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s2_validate_configmap.sh new file mode 100644 index 0000000..a5582a3 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s2_validate_configmap.sh @@ -0,0 +1,24 @@ +#!/bin/bash + +# Check if the ConfigMap exists +CM_EXISTS=$(kubectl get configmap app-config -n pod-configuration --no-headers --output=name 2>/dev/null | wc -l) +if [[ "$CM_EXISTS" -eq 0 ]]; then + echo "❌ ConfigMap 'app-config' not found in namespace 'pod-configuration'" + exit 1 +fi + +# Check for required keys +DB_HOST=$(kubectl get configmap app-config -n pod-configuration -o jsonpath='{.data.DB_HOST}' 2>/dev/null) +if [[ -z "$DB_HOST" ]]; then + echo "❌ ConfigMap 'app-config' is missing key 'DB_HOST'" + exit 1 +fi + +DB_PORT=$(kubectl get configmap app-config -n pod-configuration -o jsonpath='{.data.DB_PORT}' 2>/dev/null) +if [[ -z "$DB_PORT" ]]; then + echo "❌ ConfigMap 'app-config' is missing key 'DB_PORT'" + exit 1 +fi + +echo "✅ ConfigMap 'app-config' exists with required keys in namespace 'pod-configuration'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q20_s3_validate_secret.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s3_validate_secret.sh new file mode 100644 index 0000000..34cfa14 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s3_validate_secret.sh @@ -0,0 +1,24 @@ +#!/bin/bash + +# Check if the Secret exists +SECRET_EXISTS=$(kubectl get secret app-secret -n pod-configuration --no-headers --output=name 2>/dev/null | wc -l) +if [[ "$SECRET_EXISTS" -eq 0 ]]; then + echo "❌ Secret 'app-secret' not found in namespace 'pod-configuration'" + exit 1 +fi + +# Check for required keys +API_KEY=$(kubectl get secret app-secret -n pod-configuration -o jsonpath='{.data.API_KEY}' 2>/dev/null) +if [[ -z "$API_KEY" ]]; then + echo "❌ Secret 'app-secret' is missing key 'API_KEY'" + exit 1 +fi + +API_SECRET=$(kubectl get secret app-secret -n pod-configuration -o jsonpath='{.data.API_SECRET}' 2>/dev/null) +if [[ -z "$API_SECRET" ]]; then + echo "❌ Secret 'app-secret' is missing key 'API_SECRET'" + exit 1 +fi + +echo "✅ Secret 'app-secret' exists with required keys in namespace 'pod-configuration'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q20_s4_validate_env_vars.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s4_validate_env_vars.sh new file mode 100644 index 0000000..19aacf9 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s4_validate_env_vars.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# Check if the Pod exists +POD_EXISTS=$(kubectl get pod config-pod -n pod-configuration --no-headers --output=name 2>/dev/null | wc -l) +if [[ "$POD_EXISTS" -eq 0 ]]; then + echo "❌ Pod 'config-pod' not found in namespace 'pod-configuration'" + exit 1 +fi + +# Check for direct environment variables +APP_ENV=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="APP_ENV")].value}' 2>/dev/null) +if [[ "$APP_ENV" != "production" ]]; then + echo "❌ Pod 'config-pod' does not have environment variable 'APP_ENV=production'" + exit 1 +fi + +DEBUG=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="DEBUG")].value}' 2>/dev/null) +if [[ "$DEBUG" != "false" ]]; then + echo "❌ Pod 'config-pod' does not have environment variable 'DEBUG=false'" + exit 1 +fi + +# Check for ConfigMap environment variables +DB_HOST_REF=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="DB_HOST")].valueFrom.configMapKeyRef.name}' 2>/dev/null) +DB_HOST_KEY=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="DB_HOST")].valueFrom.configMapKeyRef.key}' 2>/dev/null) + +if [[ "$DB_HOST_REF" != "app-config" || "$DB_HOST_KEY" != "DB_HOST" ]]; then + echo "❌ Pod 'config-pod' does not have environment variable 'DB_HOST' from ConfigMap 'app-config'" + exit 1 +fi + +DB_PORT_REF=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="DB_PORT")].valueFrom.configMapKeyRef.name}' 2>/dev/null) +DB_PORT_KEY=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="DB_PORT")].valueFrom.configMapKeyRef.key}' 2>/dev/null) + +if [[ "$DB_PORT_REF" != "app-config" || "$DB_PORT_KEY" != "DB_PORT" ]]; then + echo "❌ Pod 'config-pod' does not have environment variable 'DB_PORT' from ConfigMap 'app-config'" + exit 1 +fi + +# Check for Secret environment variables +API_KEY_REF=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="API_KEY")].valueFrom.secretKeyRef.name}' 2>/dev/null) +API_KEY_KEY=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="API_KEY")].valueFrom.secretKeyRef.key}' 2>/dev/null) + +if [[ "$API_KEY_REF" != "app-secret" || "$API_KEY_KEY" != "API_KEY" ]]; then + echo "❌ Pod 'config-pod' does not have environment variable 'API_KEY' from Secret 'app-secret'" + exit 1 +fi + +API_SECRET_REF=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="API_SECRET")].valueFrom.secretKeyRef.name}' 2>/dev/null) +API_SECRET_KEY=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.containers[0].env[?(@.name=="API_SECRET")].valueFrom.secretKeyRef.key}' 2>/dev/null) + +if [[ "$API_SECRET_REF" != "app-secret" || "$API_SECRET_KEY" != "API_SECRET" ]]; then + echo "❌ Pod 'config-pod' does not have environment variable 'API_SECRET' from Secret 'app-secret'" + exit 1 +fi + +echo "✅ Pod 'config-pod' has all required environment variables configured correctly" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q20_s5_validate_configmap_mount.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s5_validate_configmap_mount.sh new file mode 100644 index 0000000..b744119 --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q20_s5_validate_configmap_mount.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +# Check if the Pod exists +POD_EXISTS=$(kubectl get pod config-pod -n pod-configuration --no-headers --output=name 2>/dev/null | wc -l) +if [[ "$POD_EXISTS" -eq 0 ]]; then + echo "❌ Pod 'config-pod' not found in namespace 'pod-configuration'" + exit 1 +fi + +# Check if there's a volume that uses the ConfigMap +CM_VOLUME=$(kubectl get pod config-pod -n pod-configuration -o jsonpath='{.spec.volumes[?(@.configMap.name=="app-config")].name}' 2>/dev/null) +if [[ -z "$CM_VOLUME" ]]; then + echo "❌ Pod 'config-pod' does not have a volume using ConfigMap 'app-config'" + exit 1 +fi + +# Check if the volume is mounted at the correct location +VOLUME_MOUNT=$(kubectl get pod config-pod -n pod-configuration -o jsonpath="{.spec.containers[0].volumeMounts[?(@.name==\"$CM_VOLUME\")].mountPath}" 2>/dev/null) +if [[ "$VOLUME_MOUNT" != "/etc/app-config" ]]; then + echo "❌ ConfigMap volume is not mounted at '/etc/app-config' in pod 'config-pod'" + exit 1 +fi + +echo "✅ Pod 'config-pod' correctly mounts ConfigMap 'app-config' as a volume at '/etc/app-config'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q9_s2_validate_deployment_replicas.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q9_s2_validate_deployment_replicas.sh new file mode 100644 index 0000000..4a21fbc --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q9_s2_validate_deployment_replicas.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +# Validate that the broken-deployment exists in troubleshooting namespace +DEPLOYMENT=$(kubectl get deployment broken-deployment -n troubleshooting -o jsonpath='{.spec.replicas}' 2>/dev/null) + +if [[ "$DEPLOYMENT" == "3" ]]; then + # Deployment exists with correct name + exit 0 +else + # Deployment does not exist or has a different name + echo "Deployment 'broken-deployment' does not have 3 replicas" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/ckad/002/scripts/validation/q9_s4_validate_pods_image.sh b/facilitator/assets/exams/ckad/002/scripts/validation/q9_s4_validate_pods_image.sh new file mode 100644 index 0000000..c8711de --- /dev/null +++ b/facilitator/assets/exams/ckad/002/scripts/validation/q9_s4_validate_pods_image.sh @@ -0,0 +1,18 @@ +# validate the container image is correct having image name nginx +# Validate if the pods of deployment 'broken-app' are running in the 'troubleshooting' namespace +#check deployment status is runing or not +DEPLOYMENT_STATUS=$(kubectl get deployment broken-deployment -n troubleshooting -o jsonpath='{.status.conditions[?(@.type=="Available")].status}') +if [ "$DEPLOYMENT_STATUS" != "True" ]; then + echo "Error: The deployment 'broken-deployment' is not running" + exit 1 +fi + +IMAGE=$(kubectl get deployment broken-deployment -n troubleshooting -o jsonpath='{.spec.template.spec.containers[0].image}' | cut -d':' -f1) + +if [ "$IMAGE" == "nginx" ]; then + echo "Success: The container image is correct" + exit 0 +else + echo "Error: The container image is not correct" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/answers.md b/facilitator/assets/exams/cks/001/answers.md index 92ba7c8..9b6b5af 100644 --- a/facilitator/assets/exams/cks/001/answers.md +++ b/facilitator/assets/exams/cks/001/answers.md @@ -276,7 +276,13 @@ spec: Create NetworkPolicy and test pods: +```bash +API_SERVER_IP=$(kubectl get svc kubernetes -n default -o jsonpath='{.spec.clusterIP}') +``` + ```yaml +cat < api-server-policy.yaml +# 1. Deny access to API server for all pods apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -291,16 +297,31 @@ spec: - ipBlock: cidr: 0.0.0.0/0 except: - - 10.96.0.1/32 # Kubernetes API server IP - namespaceSelector: {} - podSelector: {} + - ${API_SERVER_IP}/32 + +--- +# 2. Allow access to API server for pods with label role=admin +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-admin-api-egress + namespace: api-restrict +spec: + podSelector: + matchLabels: + role: admin + policyTypes: + - Egress + egress: - to: - ipBlock: - cidr: 10.96.0.1/32 # API server IP - podSelector: - matchLabels: - role: admin + cidr: ${API_SERVER_IP}/32 + ports: + - protocol: TCP + port: 443 + --- +# admin-pod (can access API server) apiVersion: v1 kind: Pod metadata: @@ -313,7 +334,9 @@ spec: - name: busybox image: busybox command: ["sleep", "3600"] + --- +# restricted-pod (blocked from API server) apiVersion: v1 kind: Pod metadata: @@ -326,6 +349,11 @@ spec: - name: busybox image: busybox command: ["sleep", "3600"] +EOF +``` + +```bash +kubectl apply -f api-server-policy.yaml ``` ## Question 9: Secure Container Configuration diff --git a/facilitator/assets/exams/cks/001/assessment.json b/facilitator/assets/exams/cks/001/assessment.json index 9250891..674fa33 100644 --- a/facilitator/assets/exams/cks/001/assessment.json +++ b/facilitator/assets/exams/cks/001/assessment.json @@ -240,17 +240,10 @@ }, { "id": "3", - "description": "Admin pod can access API server", - "verificationScriptFile": "q8_s3_validate_admin_access.sh", - "expectedOutput": "0", - "weightage": 1 - }, - { - "id": "4", "description": "Restricted pod cannot access API server", "verificationScriptFile": "q8_s4_validate_restricted_access.sh", "expectedOutput": "0", - "weightage": 1 + "weightage": 2 } ] }, @@ -380,232 +373,6 @@ "weightage": 2 } ] - }, - { - "id": "13", - "namespace": "tenant-isolation", - "machineHostname": "ckad9999", - "question": "Set up multi-tenancy isolation in the cluster by performing the following tasks:\n\n1. Create two namespaces: `tenant-a` and `tenant-b`\n2. Apply resource quotas to both namespaces limiting them to:\n - 2 pods\n - 1 CPU core total\n - 1Gi memory total\n3. Create a NetworkPolicy in each namespace that denies all ingress from the other tenant's namespace\n4. Deploy a pod named `app` in each namespace using the `nginx` image", - "concepts": ["namespaces", "resource quotas", "network policies", "multi-tenancy"], - "verification": [ - { - "id": "1", - "description": "Namespaces exist", - "verificationScriptFile": "q13_s1_validate_namespaces.sh", - "expectedOutput": "0", - "weightage": 1 - }, - { - "id": "2", - "description": "Resource quotas configured correctly", - "verificationScriptFile": "q13_s2_validate_quotas.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "3", - "description": "NetworkPolicies implemented correctly", - "verificationScriptFile": "q13_s3_validate_network_policies.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "4", - "description": "Pods deployed in each namespace", - "verificationScriptFile": "q13_s4_validate_pods.sh", - "expectedOutput": "0", - "weightage": 1 - } - ] - }, - { - "id": "14", - "namespace": "image-security", - "machineHostname": "ckad9999", - "question": "Create a small and secure container image for a simple web application:\n\n1. Create a ConfigMap named `image-specs` in the `image-security` namespace with the following data:\n - base: `alpine:3.14`\n - packages: `nginx`\n - user: `nginx`\n - entrypoint: `nginx -g 'daemon off;'`\n\n2. Write the Dockerfile contents to a ConfigMap named `dockerfile` with key `Dockerfile` that follows best practices for minimal attack surface:\n - Uses a minimal base image\n - Installs only necessary packages\n - Removes package manager cache\n - Runs as a non-root user\n - Uses a read-only root filesystem where possible\n\n3. Create a pod named `secure-image-pod` that uses the `nginx:alpine` image and runs as non-root user 101.", - "concepts": ["container images", "dockerfile security", "minimal footprint"], - "verification": [ - { - "id": "1", - "description": "ConfigMap image-specs exists", - "verificationScriptFile": "q14_s1_validate_config_specs.sh", - "expectedOutput": "0", - "weightage": 1 - }, - { - "id": "2", - "description": "Dockerfile ConfigMap exists with secure practices", - "verificationScriptFile": "q14_s2_validate_dockerfile.sh", - "expectedOutput": "0", - "weightage": 3 - }, - { - "id": "3", - "description": "Pod created with correct security context", - "verificationScriptFile": "q14_s3_validate_pod.sh", - "expectedOutput": "0", - "weightage": 1 - } - ] - }, - { - "id": "15", - "namespace": "supply-chain", - "machineHostname": "ckad9999", - "question": "Secure your supply chain by implementing a policy that only allows images from trusted registries.\n\n1. Create an ImagePolicyWebhook admission configuration in a ConfigMap named `trusted-registries` in the `supply-chain` namespace that only allows images from the following registries:\n - docker.io/library/\n - k8s.gcr.io/\n\n2. Create a pod named `verification-pod` using the `busybox` image that runs a script to verify SHA256 digests of critical container images. The script should be stored in a ConfigMap named `verify-script` with key `verify.sh`.", - "concepts": ["supply chain security", "trusted registries", "image verification"], - "verification": [ - { - "id": "1", - "description": "Trusted registries ConfigMap exists", - "verificationScriptFile": "q15_s1_validate_trusted_registries.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "2", - "description": "Verification pod and script exist", - "verificationScriptFile": "q15_s2_validate_verification_pod.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "3", - "description": "Script performs correct verification", - "verificationScriptFile": "q15_s3_validate_script.sh", - "expectedOutput": "0", - "weightage": 1 - } - ] - }, - { - "id": "16", - "namespace": "static-analysis", - "machineHostname": "ckad9999", - "question": "Perform static analysis on a Kubernetes deployment to identify security issues:\n\n1. A deployment manifest is stored in a ConfigMap named `insecure-deployment` in the `static-analysis` namespace.\n\n2. Use kubesec to analyze the deployment and store the results in a ConfigMap named `security-analysis`.\n\n3. Create an improved version of the deployment that fixes at least 3 security issues identified, and apply it as a Deployment named `secure-deployment`.", - "concepts": ["static analysis", "kubesec", "security best practices"], - "verification": [ - { - "id": "1", - "description": "Analysis results stored in ConfigMap", - "verificationScriptFile": "q16_s1_validate_analysis.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "2", - "description": "Secure deployment applied with fixes", - "verificationScriptFile": "q16_s2_validate_secure_deployment.sh", - "expectedOutput": "0", - "weightage": 3 - } - ] - }, - { - "id": "17", - "namespace": "runtime-security", - "machineHostname": "ckad9999", - "question": "Implement runtime security measures:\n\n1. Create a pod named `immutable-container` in the `runtime-security` namespace using the `nginx:alpine` image with an immutable filesystem (read-only root).\n\n2. Create a pod specification in a ConfigMap named `falco-rules` that would trigger Falco alerts for suspicious activities such as:\n - Shell execution in a container\n - Package management use in a container\n - Sensitive file access\n\n3. Create a DaemonSet named `audit-daemon` that would run on all nodes and monitor for these suspicious activities.", - "concepts": ["runtime security", "immutability", "behavioral monitoring"], - "verification": [ - { - "id": "1", - "description": "Immutable container exists", - "verificationScriptFile": "q17_s1_validate_immutable.sh", - "expectedOutput": "0", - "weightage": 1 - }, - { - "id": "2", - "description": "Falco rules ConfigMap exists", - "verificationScriptFile": "q17_s2_validate_falco_rules.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "3", - "description": "Audit DaemonSet exists", - "verificationScriptFile": "q17_s3_validate_daemonset.sh", - "expectedOutput": "0", - "weightage": 2 - } - ] - }, - { - "id": "18", - "namespace": "audit-logging", - "machineHostname": "ckad9999", - "question": "Configure Kubernetes audit logging:\n\n1. Create an audit policy ConfigMap named `audit-policy` in the `audit-logging` namespace that logs:\n - All authentication attempts at metadata level\n - All authorization failures at request level\n - All pod creation/deletion operations at RequestResponse level\n - No logging for get/list/watch operations on configmaps or secrets\n\n2. Create a pod named `audit-viewer` that would have the appropriate permissions to view these audit logs.", - "concepts": ["audit logging", "audit policy", "monitoring"], - "verification": [ - { - "id": "1", - "description": "Audit policy ConfigMap exists", - "verificationScriptFile": "q18_s1_validate_audit_policy.sh", - "expectedOutput": "0", - "weightage": 3 - }, - { - "id": "2", - "description": "Audit viewer pod exists", - "verificationScriptFile": "q18_s2_validate_audit_viewer.sh", - "expectedOutput": "0", - "weightage": 2 - } - ] - }, - { - "id": "19", - "namespace": "malicious-detection", - "machineHostname": "ckad9999", - "question": "Implement a system to detect potentially malicious activities in the cluster:\n\n1. Create a ConfigMap named `threat-detection` in the `malicious-detection` namespace with rules for detecting:\n - Unusual network communication patterns\n - Crypto mining activities\n - Privilege escalation attempts\n\n2. Deploy a pod named `detector` using the `busybox` image that would simulate running these detection rules every minute.\n\n3. Create a NetworkPolicy named `isolate-compromised` that would automatically isolate any pod labeled as `security-status=compromised`.", - "concepts": ["threat detection", "network isolation", "incident response"], - "verification": [ - { - "id": "1", - "description": "Threat detection ConfigMap exists", - "verificationScriptFile": "q19_s1_validate_threat_rules.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "2", - "description": "Detector pod exists", - "verificationScriptFile": "q19_s2_validate_detector.sh", - "expectedOutput": "0", - "weightage": 1 - }, - { - "id": "3", - "description": "Isolation NetworkPolicy exists", - "verificationScriptFile": "q19_s3_validate_isolation_policy.sh", - "expectedOutput": "0", - "weightage": 2 - } - ] - }, - { - "id": "20", - "namespace": "cilium-encryption", - "machineHostname": "ckad9999", - "question": "Implement Pod-to-Pod encryption using Cilium:\n\n1. Create a namespace named `secure-comms`.\n\n2. Create a ConfigMap named `cilium-encryption` in the `cilium-encryption` namespace with the following information describing how Cilium encryption works:\n - Key rotation mechanism\n - IPSec encryption method\n - Transparent encryption approach\n\n3. Deploy two pods in the `secure-comms` namespace: `secure-pod-a` and `secure-pod-b` using the `nginx` image with appropriate labels/annotations that would enable Cilium encryption between them. Add appropriate labels/annotations to demonstrate your understanding of Cilium Pod-to-Pod encryption.", - "concepts": ["cilium", "pod-to-pod encryption", "network security"], - "verification": [ - { - "id": "1", - "description": "Cilium encryption ConfigMap exists", - "verificationScriptFile": "q20_s1_validate_encryption_config.sh", - "expectedOutput": "0", - "weightage": 2 - }, - { - "id": "2", - "description": "Secure pods deployed with correct configuration", - "verificationScriptFile": "q20_s2_validate_secure_pods.sh", - "expectedOutput": "0", - "weightage": 3 - } - ] } ] } \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_pod.sh b/facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_pod.sh new file mode 100755 index 0000000..317bc31 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_pod.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# Validate that pod exists with seccomp profile + +POD_NAME="seccomp-pod" +NAMESPACE="seccomp-profile" + +# Check if namespace exists +kubectl get namespace $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if pod exists +kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod has seccomp profile applied +SECCOMP_PROFILE=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.securityContext.seccompProfile.type}') +if [ "$SECCOMP_PROFILE" != "RuntimeDefault" ]; then + echo "❌ Pod does not have RuntimeDefault seccomp profile applied" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod is not in Running state. Current status: $POD_STATUS" + exit 1 +fi + +echo "✅ Pod exists with RuntimeDefault seccomp profile applied" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_service_account.sh b/facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_service_account.sh deleted file mode 100644 index 3207aba..0000000 --- a/facilitator/assets/exams/cks/001/scripts/validation/q10_s1_validate_service_account.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/bash -# Validate that service account is configured properly - -SA_NAME="api-explorer" -NAMESPACE="api-explorer" - -# Check if namespace exists -kubectl get namespace $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Namespace '$NAMESPACE' not found" - exit 1 -fi - -# Check if the service account exists -kubectl get serviceaccount $SA_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ ServiceAccount '$SA_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if there's a token secret for this service account -TOKEN_NAME=$(kubectl get serviceaccount $SA_NAME -n $NAMESPACE -o jsonpath='{.secrets[0].name}' 2>/dev/null) -if [ -z "$TOKEN_NAME" ]; then - # Check if we're using Kubernetes v1.24+ where tokens are created manually - TOKEN_NAME=$(kubectl get secrets -n $NAMESPACE -o jsonpath='{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="'$SA_NAME'")].metadata.name}' 2>/dev/null) - if [ -z "$TOKEN_NAME" ]; then - echo "❌ No token found for ServiceAccount '$SA_NAME'" - exit 1 - fi -fi - -# Get the token secret details -TOKEN_DATA=$(kubectl get secret $TOKEN_NAME -n $NAMESPACE -o jsonpath='{.data.token}' 2>/dev/null) -if [ -z "$TOKEN_DATA" ]; then - echo "❌ Token data not found for ServiceAccount '$SA_NAME'" - exit 1 -fi - -echo "✅ ServiceAccount is configured properly" -exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_configmap.sh b/facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_configmap.sh new file mode 100755 index 0000000..ef98f6f --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_configmap.sh @@ -0,0 +1,47 @@ +#!/bin/bash +# Validate that ConfigMap exists with seccomp profile + +CONFIGMAP_NAME="seccomp-config" +NAMESPACE="seccomp-profile" +PROFILE_KEY="profile.json" + +# Check if namespace exists +kubectl get namespace $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if ConfigMap exists +kubectl get configmap $CONFIGMAP_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ ConfigMap '$CONFIGMAP_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Fetch profile.json from ConfigMap +PROFILE=$(kubectl get configmap $CONFIGMAP_NAME -n $NAMESPACE -o json | jq -r --arg key "$PROFILE_KEY" '.data[$key]') +if [ -z "$PROFILE" ] || [ "$PROFILE" == "null" ]; then + echo "❌ ConfigMap does not have required key '$PROFILE_KEY'" + exit 1 +fi + +# Check if profile is valid JSON +if ! echo "$PROFILE" | jq . > /dev/null 2>&1; then + echo "❌ ConfigMap content is not valid JSON" + exit 1 +fi + +# Check for required seccomp keys +if ! echo "$PROFILE" | jq -e '.defaultAction' > /dev/null 2>&1; then + echo "❌ ConfigMap does not contain a valid seccomp profile (missing defaultAction)" + exit 1 +fi + +if ! echo "$PROFILE" | jq -e '.syscalls' > /dev/null 2>&1; then + echo "❌ ConfigMap does not contain a valid seccomp profile (missing syscalls)" + exit 1 +fi + +echo "✅ ConfigMap exists with valid seccomp profile" +exit 0 diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_pod_access.sh b/facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_pod_access.sh deleted file mode 100644 index f44c1cd..0000000 --- a/facilitator/assets/exams/cks/001/scripts/validation/q10_s2_validate_pod_access.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash -# Validate that pod has proper API access - -POD_NAME="api-explorer" -NAMESPACE="api-explorer" - -# Check if namespace exists -kubectl get namespace $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Namespace '$NAMESPACE' not found" - exit 1 -fi - -# Check if the pod exists -kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if the pod is running -POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') -if [ "$POD_STATUS" != "Running" ]; then - echo "❌ Pod '$POD_NAME' is not running. Current status: $POD_STATUS" - exit 1 -fi - -# Check if the pod is using the correct service account -POD_SA=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.serviceAccountName}') -if [ "$POD_SA" != "api-explorer" ]; then - echo "❌ Pod is not using the correct ServiceAccount. Expected: api-explorer, Got: $POD_SA" - exit 1 -fi - -# Test API access from within the pod -# List pods in the current namespace to verify read access -LIST_PODS=$(kubectl exec $POD_NAME -n $NAMESPACE -- curl -s https://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/pods -k -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)") -if [[ "$LIST_PODS" == *"pods"* ]]; then - echo "✅ Pod has proper API access" - exit 0 -else - echo "❌ Pod cannot access the Kubernetes API properly" - exit 1 -fi \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_rbac_rules.sh b/facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_rbac_rules.sh deleted file mode 100644 index 1fbb0dd..0000000 --- a/facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_rbac_rules.sh +++ /dev/null @@ -1,64 +0,0 @@ -#!/bin/bash -# Validate that RBAC rules are properly configured - -SA_NAME="api-explorer" -NAMESPACE="api-explorer" -ROLE_NAME="api-explorer-role" -ROLEBINDING_NAME="api-explorer-binding" - -# Check if namespace exists -kubectl get namespace $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Namespace '$NAMESPACE' not found" - exit 1 -fi - -# Check if Role exists -kubectl get role $ROLE_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Role '$ROLE_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if RoleBinding exists -kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ RoleBinding '$ROLEBINDING_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if Role has proper rules (can list/get/watch pods and services) -RESOURCES=$(kubectl get role $ROLE_NAME -n $NAMESPACE -o jsonpath='{.rules[*].resources}') -if [[ "$RESOURCES" != *"pods"* ]] || [[ "$RESOURCES" != *"services"* ]]; then - echo "❌ Role does not have access to required resources (pods and services)" - exit 1 -fi - -VERBS=$(kubectl get role $ROLE_NAME -n $NAMESPACE -o jsonpath='{.rules[*].verbs}') -if [[ "$VERBS" != *"get"* ]] || [[ "$VERBS" != *"list"* ]] || [[ "$VERBS" != *"watch"* ]]; then - echo "❌ Role does not have required verbs (get, list, watch)" - exit 1 -fi - -# Check if RoleBinding references the correct Role -REFERENCED_ROLE=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.roleRef.name}') -if [ "$REFERENCED_ROLE" != "$ROLE_NAME" ]; then - echo "❌ RoleBinding references incorrect Role. Expected: $ROLE_NAME, Got: $REFERENCED_ROLE" - exit 1 -fi - -# Check if RoleBinding is bound to the correct ServiceAccount -SUBJECT_NAME=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.subjects[0].name}') -if [ "$SUBJECT_NAME" != "$SA_NAME" ]; then - echo "❌ RoleBinding not bound to correct ServiceAccount. Expected: $SA_NAME, Got: $SUBJECT_NAME" - exit 1 -fi - -# Verify that the role doesn't allow deletion or modification operations -if [[ "$VERBS" == *"delete"* ]] || [[ "$VERBS" == *"create"* ]] || [[ "$VERBS" == *"update"* ]] || [[ "$VERBS" == *"patch"* ]]; then - echo "❌ Role allows modification operations (create/update/delete/patch) which should be restricted" - exit 1 -fi - -echo "✅ RBAC rules are properly configured" -exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_syscalls.sh b/facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_syscalls.sh new file mode 100755 index 0000000..cf44e17 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q10_s3_validate_syscalls.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# Validate that seccomp profile allows required syscalls + +CONFIGMAP_NAME="seccomp-config" +NAMESPACE="seccomp-profile" +PROFILE_KEY="profile.json" +REQUIRED_SYSCALLS=("exit" "exit_group" "rt_sigreturn" "read" "write" "open") + +# Check if namespace exists +kubectl get namespace "$NAMESPACE" &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if ConfigMap exists +kubectl get configmap "$CONFIGMAP_NAME" -n "$NAMESPACE" &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ ConfigMap '$CONFIGMAP_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Extract profile JSON from ConfigMap using jq instead of jsonpath +PROFILE=$(kubectl get configmap "$CONFIGMAP_NAME" -n "$NAMESPACE" -o json | jq -r --arg key "$PROFILE_KEY" '.data[$key]') + +if [ -z "$PROFILE" ] || [ "$PROFILE" == "null" ]; then + echo "❌ ConfigMap does not have required key '$PROFILE_KEY'" + exit 1 +fi + +# Check if it's valid JSON +if ! echo "$PROFILE" | jq . > /dev/null 2>&1; then + echo "❌ Profile is not valid JSON" + exit 1 +fi + +# Check if defaultAction is SCMP_ACT_ERRNO +DEFAULT_ACTION=$(echo "$PROFILE" | jq -r '.defaultAction') +if [ "$DEFAULT_ACTION" != "SCMP_ACT_ERRNO" ]; then + echo "❌ Profile defaultAction is not SCMP_ACT_ERRNO (actual: $DEFAULT_ACTION)" + exit 1 +fi + +# Extract all allowed syscall names into a flat list +ALLOWED_SYSCALLS=$(echo "$PROFILE" | jq -r '[.syscalls[] | select(.action == "SCMP_ACT_ALLOW") | .names[]] | unique | .[]') + +# Check if all required syscalls are in the allowed list +for syscall in "${REQUIRED_SYSCALLS[@]}"; do + if ! echo "$ALLOWED_SYSCALLS" | grep -q -w "$syscall"; then + echo "❌ Required syscall not allowed: $syscall" + exit 1 + fi +done + +echo "✅ Seccomp profile allows all required syscalls" +exit 0 diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q6_s3_validate_rolebinding.sh b/facilitator/assets/exams/cks/001/scripts/validation/q6_s3_validate_rolebinding.sh new file mode 100755 index 0000000..0c588d2 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q6_s3_validate_rolebinding.sh @@ -0,0 +1,45 @@ +#!/bin/bash +# Validate that the RoleBinding exists and is correct + +NAMESPACE="rbac-minimize" +ROLEBINDING_NAME="app-reader-binding" +ROLE_NAME="app-reader-role" +SERVICE_ACCOUNT="app-reader" + +# Check if namespace exists +kubectl get namespace $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if RoleBinding exists +kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ RoleBinding '$ROLEBINDING_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if RoleBinding references the correct Role +ROLE_REF=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.roleRef.name}') +if [ "$ROLE_REF" != "$ROLE_NAME" ]; then + echo "❌ RoleBinding does not reference the correct Role '$ROLE_NAME' (actual: $ROLE_REF)" + exit 1 +fi + +# Check if RoleBinding references the correct ServiceAccount +SUBJECT_KIND=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.subjects[0].kind}') +SUBJECT_NAME=$(kubectl get rolebinding $ROLEBINDING_NAME -n $NAMESPACE -o jsonpath='{.subjects[0].name}') + +if [ "$SUBJECT_KIND" != "ServiceAccount" ]; then + echo "❌ RoleBinding subject is not a ServiceAccount (actual: $SUBJECT_KIND)" + exit 1 +fi + +if [ "$SUBJECT_NAME" != "$SERVICE_ACCOUNT" ]; then + echo "❌ RoleBinding does not reference the correct ServiceAccount '$SERVICE_ACCOUNT' (actual: $SUBJECT_NAME)" + exit 1 +fi + +echo "✅ RoleBinding exists and is correctly configured" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_policy_exists.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_policy_exists.sh new file mode 100755 index 0000000..c49d72a --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_policy_exists.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# Validate that the NetworkPolicy exists + +POLICY_NAME="api-server-policy" +NAMESPACE="api-restrict" + +# Check if namespace exists +kubectl get namespace $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if NetworkPolicy exists +kubectl get networkpolicy $POLICY_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ NetworkPolicy '$POLICY_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +echo "✅ NetworkPolicy '$POLICY_NAME' exists in namespace '$NAMESPACE'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_sec_profile_exists.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_sec_profile_exists.sh deleted file mode 100644 index 85b8145..0000000 --- a/facilitator/assets/exams/cks/001/scripts/validation/q8_s1_validate_sec_profile_exists.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash -# Validate that the security profile exists - -PROFILE_NAME="restricted-profile" -NAMESPACE="seccomp" - -# Check if the pod security policy exists as a ConfigMap -kubectl get configmap $PROFILE_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Security profile ConfigMap '$PROFILE_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if the ConfigMap has the seccomp profile content -PROFILE_CONTENT=$(kubectl get configmap $PROFILE_NAME -n $NAMESPACE -o jsonpath='{.data.profile\.json}') -if [ -z "$PROFILE_CONTENT" ]; then - echo "❌ Security profile does not contain the required 'profile.json' key in ConfigMap" - exit 1 -fi - -# Check if the profile content has the expected fields -if [[ "$PROFILE_CONTENT" != *"defaultAction"* ]] || [[ "$PROFILE_CONTENT" != *"syscalls"* ]]; then - echo "❌ Security profile does not have the required content (defaultAction and syscalls fields)" - exit 1 -fi - -echo "✅ Security profile exists and has required content" -exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_default_deny.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_default_deny.sh deleted file mode 100644 index 18ebd39..0000000 --- a/facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_default_deny.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/bash -# Validate that the security profile has default deny - -PROFILE_NAME="restricted-profile" -NAMESPACE="seccomp" - -# Check if the pod security policy exists as a ConfigMap -kubectl get configmap $PROFILE_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Security profile ConfigMap '$PROFILE_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if the ConfigMap has the seccomp profile content -PROFILE_CONTENT=$(kubectl get configmap $PROFILE_NAME -n $NAMESPACE -o jsonpath='{.data.profile\.json}') -if [ -z "$PROFILE_CONTENT" ]; then - echo "❌ Security profile does not contain the required 'profile.json' key in ConfigMap" - exit 1 -fi - -# Check if the profile has defaultAction set to SCMP_ACT_ERRNO -DEFAULT_ACTION=$(echo "$PROFILE_CONTENT" | grep -o '"defaultAction":[[:space:]]*"[^"]*"' | cut -d'"' -f4) -if [ "$DEFAULT_ACTION" != "SCMP_ACT_ERRNO" ]; then - echo "❌ Security profile does not have defaultAction set to SCMP_ACT_ERRNO. Found: $DEFAULT_ACTION" - exit 1 -fi - -echo "✅ Security profile has default deny (defaultAction: SCMP_ACT_ERRNO)" -exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_policy_selectors.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_policy_selectors.sh new file mode 100755 index 0000000..972c118 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q8_s2_validate_policy_selectors.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# Validate that the NetworkPolicy has correct selectors and egress rules + +POLICY_NAME="api-server-policy" +NAMESPACE="api-restrict" + +# Check if namespace exists +kubectl get namespace "$NAMESPACE" &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if NetworkPolicy exists +kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ NetworkPolicy '$POLICY_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if policy includes Egress in policyTypes +POLICY_TYPES=$(kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o jsonpath='{.spec.policyTypes}') +if [[ "$POLICY_TYPES" != *"Egress"* ]]; then + echo "❌ NetworkPolicy does not include Egress in policyTypes" + exit 1 +fi + +# Check if it denies traffic to API server IP +API_SERVER_IP=$(kubectl get svc kubernetes -n default -o jsonpath='{.spec.clusterIP}') +if ! kubectl get networkpolicy "$POLICY_NAME" -n "$NAMESPACE" -o json | grep -q "$API_SERVER_IP"; then + echo "❌ NetworkPolicy does not target the API server IP ($API_SERVER_IP)" + exit 1 +fi + +echo "✅ NetworkPolicy '$POLICY_NAME' is correctly configured" +exit 0 diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_admin_access.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_admin_access.sh new file mode 100755 index 0000000..66ffed0 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_admin_access.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +NAMESPACE="api-restrict" +ADMIN_POD="admin-pod" +RESTRICTED_POD="restricted-pod" + +echo "🔍 Getting Kubernetes API Server IP..." +API_SERVER_IP=$(kubectl get endpoints kubernetes -o jsonpath='{.subsets[0].addresses[0].ip}') +if [ -z "$API_SERVER_IP" ]; then + echo "❌ Could not find API server IP" + exit 1 +fi +echo "✅ API Server IP: $API_SERVER_IP" + +# Function to check pod and label +check_pod_and_label() { + local pod_name=$1 + local expected_label=$2 + + echo "🔍 Checking pod '$pod_name' in namespace '$NAMESPACE'..." + + kubectl get pod "$pod_name" -n "$NAMESPACE" &> /dev/null + if [ $? -ne 0 ]; then + echo "❌ Pod '$pod_name' not found" + exit 1 + fi + + label=$(kubectl get pod "$pod_name" -n "$NAMESPACE" -o jsonpath='{.metadata.labels.role}') + if [ "$label" != "$expected_label" ]; then + echo "❌ Pod '$pod_name' does not have label 'role=$expected_label'" + exit 1 + fi + + echo "✅ Pod '$pod_name' has correct label 'role=$expected_label'" +} + +# Function to test connectivity +test_connectivity() { + local pod_name=$1 + local expect_success=$2 + + echo "🚀 Testing connectivity from '$pod_name' to API server..." + + kubectl exec -n "$NAMESPACE" "$pod_name" -- nc -z -w2 "$API_SERVER_IP" 443 &> /dev/null + result=$? + + if [ $expect_success -eq 1 ] && [ $result -eq 0 ]; then + echo "✅ '$pod_name' can access the API server as expected" + elif [ $expect_success -eq 1 ]; then + echo "❌ '$pod_name' could NOT access the API server (but it should)" + exit 1 + elif [ $expect_success -eq 0 ] && [ $result -ne 0 ]; then + echo "✅ '$pod_name' is correctly restricted from accessing the API server" + else + echo "❌ '$pod_name' accessed the API server (but it should NOT)" + exit 1 + fi +} + +echo "🔎 Validating..." + +check_pod_and_label "$ADMIN_POD" "admin" +check_pod_and_label "$RESTRICTED_POD" "restricted" + +test_connectivity "$ADMIN_POD" 1 # Should succeed +test_connectivity "$RESTRICTED_POD" 0 # Should fail + +echo "🎉 All validations passed!" diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_allowed_syscalls.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s3_validate_allowed_syscalls.sh old mode 100644 new mode 100755 diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_pod_seccomp.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_pod_seccomp.sh deleted file mode 100644 index 2ab42fc..0000000 --- a/facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_pod_seccomp.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -# Validate that the pod uses the security profile - -POD_NAME="seccomp-pod" -NAMESPACE="seccomp" -PROFILE_NAME="restricted-profile" - -# Check if the pod exists -kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null -if [ $? -ne 0 ]; then - echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" - exit 1 -fi - -# Check if the pod uses a seccomp profile -SECCOMP_PROFILE=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.securityContext.seccompProfile.type}') -if [ "$SECCOMP_PROFILE" != "Localhost" ]; then - echo "❌ Pod does not use a Localhost seccomp profile. Found: $SECCOMP_PROFILE" - exit 1 -fi - -# Check if the pod uses the correct seccomp profile path -SECCOMP_PATH=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.securityContext.seccompProfile.localhostProfile}') -if [[ "$SECCOMP_PATH" != *"$PROFILE_NAME"* ]] && [[ "$SECCOMP_PATH" != *"profile.json"* ]]; then - echo "❌ Pod does not use the correct seccomp profile path. Found: $SECCOMP_PATH" - exit 1 -fi - -echo "✅ Pod uses the correct seccomp profile" -exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_restricted_access.sh b/facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_restricted_access.sh new file mode 100755 index 0000000..4f7fdea --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q8_s4_validate_restricted_access.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# Validate that restricted pod cannot access API server + +NAMESPACE="api-restrict" +POD_NAME="restricted-pod" + +# Check if namespace exists +kubectl get namespace $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if pod exists +kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod has the right label +POD_LABEL=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.metadata.labels.role}') +if [ "$POD_LABEL" != "restricted" ]; then + echo "❌ Pod '$POD_NAME' does not have label 'role=restricted'" + exit 1 +fi + +# Test if the pod can access the API server - it should fail due to NetworkPolicy +API_SERVER_IP=$(kubectl get endpoints kubernetes -o jsonpath='{.subsets[0].addresses[0].ip}') +TEST_RESULT=$(kubectl exec -n $NAMESPACE $POD_NAME -- wget -T 3 -q -O- "https://$API_SERVER_IP:443" 2>&1) + +if ! echo "$TEST_RESULT" | grep -q "Connection refused\|timed out\|Unable to connect"; then + echo "❌ Restricted pod can access API server when it should be blocked" + exit 1 +fi + +echo "✅ Restricted pod correctly blocked from accessing API server" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_enc_secret.sh b/facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_enc_secret.sh old mode 100644 new mode 100755 diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_pod_exists.sh b/facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_pod_exists.sh new file mode 100755 index 0000000..b7f7e87 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q9_s1_validate_pod_exists.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Validate that pod exists + +POD_NAME="secure-container" +NAMESPACE="os-hardening" + +# Check if namespace exists +kubectl get namespace $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Namespace '$NAMESPACE' not found" + exit 1 +fi + +# Check if pod exists +kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod is running +POD_STATUS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.status.phase}') +if [ "$POD_STATUS" != "Running" ]; then + echo "❌ Pod '$POD_NAME' is not in Running state (current state: $POD_STATUS)" + exit 1 +fi + +echo "✅ Pod '$POD_NAME' exists and is running in namespace '$NAMESPACE'" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_capabilities.sh b/facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_capabilities.sh new file mode 100755 index 0000000..02a30d9 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_capabilities.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Validate that the pod has correct capabilities configuration + +POD_NAME="secure-container" +NAMESPACE="os-hardening" +REQUIRED_DROP_CAPS=("ALL") +REQUIRED_ADD_CAPS=("NET_BIND_SERVICE") + +# Check if pod exists +kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if the pod has dropped ALL capabilities +DROP_CAPS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].securityContext.capabilities.drop}') +for cap in "${REQUIRED_DROP_CAPS[@]}"; do + if [[ "$DROP_CAPS" != *"$cap"* ]]; then + echo "❌ Pod has not dropped required capability: $cap" + exit 1 + fi +done + +# Check if the pod has added the required capabilities +ADD_CAPS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].securityContext.capabilities.add}') +for cap in "${REQUIRED_ADD_CAPS[@]}"; do + if [[ "$ADD_CAPS" != *"$cap"* ]]; then + echo "❌ Pod has not added required capability: $cap" + exit 1 + fi +done + +echo "✅ Pod has correct capabilities configuration (dropped ALL, added NET_BIND_SERVICE)" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_config_file.sh b/facilitator/assets/exams/cks/001/scripts/validation/q9_s2_validate_config_file.sh old mode 100644 new mode 100755 diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q9_s3_validate_readonly_fs.sh b/facilitator/assets/exams/cks/001/scripts/validation/q9_s3_validate_readonly_fs.sh new file mode 100755 index 0000000..e03661f --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q9_s3_validate_readonly_fs.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# Validate that the pod uses a read-only root filesystem + +POD_NAME="secure-container" +NAMESPACE="os-hardening" + +# Check if pod exists +kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if readOnlyRootFilesystem is set to true +READONLY_ROOT=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].securityContext.readOnlyRootFilesystem}') +if [ "$READONLY_ROOT" != "true" ]; then + echo "❌ Pod does not have readOnlyRootFilesystem set to true" + exit 1 +fi + +# Check for required volume mounts for nginx to function with read-only filesystem +VOLUME_MOUNTS=$(kubectl get pod $POD_NAME -n $NAMESPACE -o json | jq -r '.spec.containers[0].volumeMounts[].mountPath') +if ! echo "$VOLUME_MOUNTS" | grep -q "/tmp"; then + echo "❌ Pod is missing required volume mount for /tmp" + exit 1 +fi + +if ! echo "$VOLUME_MOUNTS" | grep -q "/var/cache/nginx"; then + echo "❌ Pod is missing required volume mount for /var/cache/nginx" + exit 1 +fi + +if ! echo "$VOLUME_MOUNTS" | grep -q "/var/run"; then + echo "❌ Pod is missing required volume mount for /var/run" + exit 1 +fi + +echo "✅ Pod uses a read-only root filesystem with appropriate volume mounts" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/cks/001/scripts/validation/q9_s4_validate_user_group.sh b/facilitator/assets/exams/cks/001/scripts/validation/q9_s4_validate_user_group.sh new file mode 100755 index 0000000..09e7491 --- /dev/null +++ b/facilitator/assets/exams/cks/001/scripts/validation/q9_s4_validate_user_group.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# Validate that the pod runs as the correct user and group + +POD_NAME="secure-container" +NAMESPACE="os-hardening" +REQUIRED_USER_ID=1000 +REQUIRED_GROUP_ID=3000 + +# Check if pod exists +kubectl get pod $POD_NAME -n $NAMESPACE &> /dev/null +if [ $? -ne 0 ]; then + echo "❌ Pod '$POD_NAME' not found in namespace '$NAMESPACE'" + exit 1 +fi + +# Check if pod runs as the correct user +RUN_AS_USER=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].securityContext.runAsUser}') +if [ "$RUN_AS_USER" != "$REQUIRED_USER_ID" ]; then + echo "❌ Pod does not run as user ID $REQUIRED_USER_ID (actual: $RUN_AS_USER)" + exit 1 +fi + +# Check if pod runs as the correct group +RUN_AS_GROUP=$(kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.spec.containers[0].securityContext.runAsGroup}') +if [ "$RUN_AS_GROUP" != "$REQUIRED_GROUP_ID" ]; then + echo "❌ Pod does not run as group ID $REQUIRED_GROUP_ID (actual: $RUN_AS_GROUP)" + exit 1 +fi + +echo "✅ Pod runs as user ID $REQUIRED_USER_ID and group ID $REQUIRED_GROUP_ID" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/labs.json b/facilitator/assets/exams/labs.json index 986b0f5..0cf26da 100644 --- a/facilitator/assets/exams/labs.json +++ b/facilitator/assets/exams/labs.json @@ -16,7 +16,7 @@ "name": "CKAD Comprehensive Lab - 2", "category": "CKAD", "description": "Series of practical tasks on multi-container pods, pod design patterns, configuration, services, and networking in Kubernetes environments.", - "warmUpTimeInSeconds": 180, + "warmUpTimeInSeconds": 260, "difficulty": "Hard", "examDurationInMinutes": 120 }, @@ -27,8 +27,38 @@ "category": "CKS", "description": "Practice essential Kubernetes security concepts including network policies, RBAC, supply chain security, and runtime protection", "warmUpTimeInSeconds": 180, - "difficulty": "Medium", + "difficulty": "Hard", "examDurationInMinutes": 120 + }, + { + "id": "cka-001", + "assetPath": "assets/exams/cka/001", + "name": "CKA Practice Lab - Core Concepts", + "category": "CKA", + "description": "Practice essential Kubernetes administrator tasks covering cluster management, networking, storage, and security", + "warmUpTimeInSeconds": 160, + "difficulty": "Easy", + "examDurationInMinutes": 60 + }, + { + "id": "docker-001", + "assetPath": "assets/exams/other/001", + "name": "Docker Speed Run - Core Concepts", + "category": "Other", + "description": "Fast-paced practice lab covering Docker fundamentals including images, containers, volumes, networking, OCI, logging, and security best practices.", + "warmUpTimeInSeconds": 120, + "difficulty": "Medium", + "examDurationInMinutes": 90 + }, + { + "id": "helm-001", + "assetPath": "assets/exams/other/002", + "name": "Helm Fundamentals Lab", + "category": "Other", + "description": "Comprehensive lab covering Helm basics including chart installation, repositories, customization, packaging, debugging, and advanced Helm operations for Kubernetes applications.", + "warmUpTimeInSeconds": 120, + "difficulty": "Medium", + "examDurationInMinutes": 90 } ] } \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/answers.md b/facilitator/assets/exams/other/001/answers.md new file mode 100644 index 0000000..af75840 --- /dev/null +++ b/facilitator/assets/exams/other/001/answers.md @@ -0,0 +1,404 @@ +# Docker Speed Run - Core Concepts: Solutions + +## Question 1: Create and tag a Docker image + +**Task**: Create a Docker image named `docker-speedrun:v1` using the provided Dockerfile and tag it as `docker-speedrun:latest`. + +**Solution**: +```bash +# Navigate to the directory containing the Dockerfile +cd /tmp/exam/q1 + +# Build the image with the tag docker-speedrun:v1 +docker build -t docker-speedrun:v1 . + +# Tag the image as docker-speedrun:latest +docker tag docker-speedrun:v1 docker-speedrun:latest + +# Verify the images exist +docker images | grep docker-speedrun +``` + +## Question 2: Run a container with specific parameters + +**Task**: Run a container using nginx:alpine with specific parameters. + +**Solution**: +```bash +docker run -d --name web-server -p 8080:80 -e NGINX_HOST=localhost nginx:alpine + +# Verify the container is running +docker ps | grep web-server + +# Verify environment variable +docker exec web-server env | grep NGINX_HOST +``` + +## Question 3: Create and use a Docker volume + +**Task**: Create a Docker volume and use it in a container to persist data. + +**Solution**: +```bash +# Create the volume +docker volume create data-volume + +# Run a container that mounts the volume and creates a file +docker run --name volume-test -v data-volume:/app/data alpine:latest sh -c "mkdir -p /app/data && echo 'Docker volumes test' > /app/data/test.txt" + +# Verify the data was persisted +docker run --rm -v data-volume:/app/data alpine:latest cat /app/data/test.txt +``` + +## Question 4: Create a multi-stage Dockerfile + +**Task**: Create a multi-stage Dockerfile to build a Go application with a minimal final image. + +**Solution**: +``` +FROM golang:1.17-alpine AS builder +WORKDIR /app +COPY /tmp/exam/q4/main.go . +RUN go build -o app . + +FROM alpine:latest +WORKDIR /root/ +COPY --from=builder /app/app . +ENTRYPOINT ["./app"] +``` + +Build command: +```bash +cd /tmp/exam/q4 +docker build -t multi-stage:latest . +``` + +## Question 5: Configure Docker daemon with systemd cgroup driver + +**Task**: Configure the Docker daemon to use the systemd cgroup driver. + +**Solution**: +```bash +# Create or edit the daemon.json file +cat > /etc/docker/daemon.json << EOF +{ + "exec-opts": ["native.cgroupdriver=systemd"], + "log-driver": "json-file", + "log-opts": { + "max-size": "100m" + }, + "storage-driver": "overlay2" +} +EOF + +# Restart Docker service +systemctl restart docker + +# Verify the configuration +docker info | grep -i cgroup +``` + +## Question 6: Configure container logging + +**Task**: Run a container with specific logging configuration. + +**Solution**: +```bash +docker run -d --name logging-test \ + --log-driver json-file \ + --log-opt max-size=10m \ + --log-opt max-file=3 \ + nginx:alpine + +# Verify logging configuration +docker inspect logging-test --format '{{.HostConfig.LogConfig}}' +``` + +## Question 7: Create a custom network and use container DNS + +**Task**: Create a custom bridge network and test container DNS resolution. + +**Solution**: +```bash +# Create the custom network +docker network create --subnet=172.18.0.0/16 app-network + +# Run the first container in detached mode +docker run -d --name app1 --network app-network alpine sleep 1000 + +# Run the second container to ping the first one +docker run --name app2 --network app-network alpine ping -c 3 app1 + +# Verify the containers used the correct network +docker network inspect app-network +``` + +## Question 8: Implement Docker healthchecks + +**Task**: Create a Dockerfile with healthcheck for a web application. + +**Solution**: +``` +FROM nginx:alpine + +# Install curl for the healthcheck +RUN apk add --no-cache curl + +# Configure the healthcheck +HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \ + CMD curl -f http://localhost:80/ || exit 1 + +EXPOSE 80 + +CMD ["nginx", "-g", "daemon off;"] +``` + +Build and run command: +```bash +cd /tmp/exam/q8 +docker build -t healthy-nginx . +docker run -d --name healthy-app healthy-nginx + +# Check health status +docker inspect --format='{{.State.Health.Status}}' healthy-app +``` + +## Question 9: Work with OCI image manifests + +**Task**: Pull and analyze an image manifest. + +**Solution**: +```bash +# Pull the image +docker pull nginx:1.21.0 + +# Get the image manifest and save to file +mkdir -p /tmp/exam/q9 +docker manifest inspect nginx:1.21.0 > /tmp/exam/q9/manifest.json + +# Extract platforms information +cat /tmp/exam/q9/manifest.json | grep -A 10 "platform" | grep "architecture\|os" | sort | uniq > /tmp/exam/q9/platforms.txt +``` + +## Question 10: Set container resource limits + +**Task**: Run a container with CPU and memory limits. + +**Solution**: +```bash +docker run -d --name limited-resources \ + --cpus=0.5 \ + --memory=256m \ + stress --cpu 1 + +# Verify the limits +docker inspect limited-resources --format '{{.HostConfig.NanoCpus}}' +docker inspect limited-resources --format '{{.HostConfig.Memory}}' +``` + +## Question 11: Create a Docker Compose configuration + +**Task**: Create a Docker Compose file for a web and database application. + +**Solution**: +```yaml +version: '3' + +services: + web: + image: nginx:alpine + ports: + - "8080:80" + networks: + - app-network + depends_on: + - db + + db: + image: postgres:13 + environment: + - POSTGRES_USER=dbuser + - POSTGRES_PASSWORD=dbpassword + - POSTGRES_DB=myapp + volumes: + - db-data:/var/lib/postgresql/data + networks: + - app-network + +networks: + app-network: + driver: bridge + +volumes: + db-data: +``` + +Start services: +```bash +cd /tmp/exam/q11 +docker-compose up -d +``` + +## Question 12: Analyze a Docker image + +**Task**: Analyze and report on an existing Docker image. + +**Solution**: +```bash +mkdir -p /tmp/exam/q12 + +# Pull the image if not already available +docker pull webapp:latest + +# Analyze the image and create the report +cat > /tmp/exam/q12/image-report.txt << EOF +Base Image: $(docker inspect webapp:latest --format '{{.Config.Image}}') +Number of Layers: $(docker history webapp:latest | wc -l) +Exposed Ports: $(docker inspect webapp:latest --format '{{.Config.ExposedPorts}}') +Environment Variables: $(docker inspect webapp:latest --format '{{.Config.Env}}') +Entrypoint: $(docker inspect webapp:latest --format '{{.Config.Entrypoint}}') +EOF +``` + +## Question 13: Troubleshoot a container + +**Task**: Fix an issue with a broken container. + +**Solution**: +```bash +mkdir -p /tmp/exam/q13 + +# Check container logs +docker logs broken-container > /tmp/exam/q13/container-logs.txt + +# Examine the container +docker exec -it broken-container ls -la /app + +# Fix the issue by creating the missing file +docker exec -it broken-container sh -c 'echo "{\"config\": \"fixed\"}" > /app/config.json' + +# Document the diagnosis +cat > /tmp/exam/q13/diagnosis.txt << EOF +Issue: The container was missing a required configuration file at /app/config.json +Symptoms: Container was failing to start properly due to missing configuration +Solution: Created the missing config.json file with basic configuration +EOF +``` + +## Question 14: Create a Docker container with non-root user + +**Task**: Create a Dockerfile that runs as a non-root user for improved security. + +**Solution**: +``` +FROM python:3.9-slim + +# Create a non-root user +RUN useradd -u 1001 -m appuser + +# Set the working directory +WORKDIR /app + +# Copy the application code +COPY /tmp/exam/q14/app.py . + +# Change ownership to the non-root user +RUN chown -R appuser:appuser /app + +# Switch to the non-root user +USER appuser + +# Set the entrypoint +ENTRYPOINT ["python", "app.py"] +``` + +Build and run: +```bash +cd /tmp/exam/q14 +docker build -t secure-app . +docker run -d --name secure-app secure-app + +# Verify the user +docker exec secure-app whoami +``` + +## Question 15: Optimize a Dockerfile + +**Task**: Optimize an existing Dockerfile for better build performance and smaller size. + +**Solution**: + +Creating a .dockerignore file: +``` +.git +node_modules +npm-debug.log +Dockerfile +.dockerignore +*.md +*.log +``` + +Optimized Dockerfile: +``` +FROM node:14-alpine + +WORKDIR /app + +# Copy package files first to leverage caching +COPY package*.json ./ +RUN npm install --production + +# Then copy application code +COPY . . + +# Use multi-stage build to create smaller final image +FROM node:14-alpine +WORKDIR /app +COPY --from=0 /app/node_modules ./node_modules +COPY --from=0 /app/package.json ./ +COPY --from=0 /app/src ./src + +# Combine multiple commands to reduce layers +ENV NODE_ENV=production \ + PORT=3000 + +EXPOSE 3000 + +# Use exec form of CMD +CMD ["node", "src/index.js"] +``` + +Build command: +```bash +cd /tmp/exam/q15 +docker build -t optimized-app:latest . +``` + +## Question 16: Docker Content Trust + +**Task**: Configure and use Docker Content Trust for image signing. + +**Solution**: +```bash +# Commands saved to file +cat > /tmp/exam/q16/dct-commands.sh << EOF +#!/bin/bash + +# Enable Docker Content Trust +export DOCKER_CONTENT_TRUST=1 + +# Pull a signed image +docker pull docker.io/library/alpine:latest + +# Configure passphrase for signing +export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="my-secure-passphrase" + +# Build and push a signed image to local registry +docker build -t localhost:5000/secure-app:latest . +docker push localhost:5000/secure-app:latest +EOF + +# Make the file executable +chmod +x /tmp/exam/q16/dct-commands.sh +``` \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/assessment.json b/facilitator/assets/exams/other/001/assessment.json new file mode 100644 index 0000000..64aee32 --- /dev/null +++ b/facilitator/assets/exams/other/001/assessment.json @@ -0,0 +1,449 @@ +{ + "questions": [ + { + "id": "1", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a Docker image named `docker-speedrun:v1` using the provided Dockerfile in the `/tmp/exam/q1` directory.\n\nTag the image also as `docker-speedrun:latest`.", + "concepts": ["docker", "images", "tags"], + "verification": [ + { + "id": "1", + "description": "Image docker-speedrun:v1 exists", + "verificationScriptFile": "q1_s1_validate_image_v1.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Image docker-speedrun:latest exists", + "verificationScriptFile": "q1_s2_validate_image_latest.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "2", + "namespace": "default", + "machineHostname": "node01", + "question": "Run a container named `web-server` using the `nginx:alpine` image. The container should:\n\n- Run in detached mode\n- Map host port `8080` to container port `80`\n- Set an environment variable `NGINX_HOST=localhost`", + "concepts": ["docker", "containers", "port mapping", "environment variables"], + "verification": [ + { + "id": "1", + "description": "Container web-server is running", + "verificationScriptFile": "q2_s1_validate_container_running.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Container uses the correct image", + "verificationScriptFile": "q2_s2_validate_image.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "Port mapping is correct", + "verificationScriptFile": "q2_s3_validate_port.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "4", + "description": "Environment variable is set correctly", + "verificationScriptFile": "q2_s4_validate_env.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "3", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a Docker volume named `data-volume` and then run a container named `volume-test` using the `alpine:latest` image that:\n\n- Mounts the `data-volume` to `/app/data` in the container\n- Creates a file called `/app/data/test.txt` with the content 'Docker volumes test'\n- Exits after completing these actions", + "concepts": ["docker", "volumes", "data persistence"], + "verification": [ + { + "id": "1", + "description": "Volume data-volume exists", + "verificationScriptFile": "q3_s1_validate_volume.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Container was created with correct mount", + "verificationScriptFile": "q3_s2_validate_container_mount.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "File exists in the volume with correct content", + "verificationScriptFile": "q3_s3_validate_file_content.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "4", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a multi-stage Dockerfile in `/tmp/exam/q4/Dockerfile` that:\n\n- Uses `golang:1.17-alpine` as the build stage\n- Builds a simple Go application from `/tmp/exam/q4/main.go`\n- Uses `alpine:latest` as the final stage\n- Copies only the compiled binary to the final stage\n- Sets the entrypoint to run the binary\n\nThen build this image with the tag `multi-stage:latest`.", + "concepts": ["docker", "multi-stage builds", "optimization"], + "verification": [ + { + "id": "1", + "description": "Dockerfile exists and has multiple stages", + "verificationScriptFile": "q4_s1_validate_dockerfile.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Image was built successfully", + "verificationScriptFile": "q4_s2_validate_image_built.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "3", + "description": "Image size is optimized (under 20MB)", + "verificationScriptFile": "q4_s3_validate_image_size.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "5", + "namespace": "default", + "machineHostname": "node01", + "question": "Configure the Docker daemon to use the systemd cgroup driver and restart the Docker service. Then verify the configuration.\n\nEdit the Docker daemon configuration file at `/etc/docker/daemon.json`.", + "concepts": ["docker", "configuration", "cgroups", "systemd"], + "verification": [ + { + "id": "1", + "description": "Configuration file has correct settings", + "verificationScriptFile": "q5_s1_validate_daemon_config.sh", + "expectedOutput": "0", + "weightage": 4 + }, + { + "id": "2", + "description": "Docker service is running with systemd cgroup driver", + "verificationScriptFile": "q5_s2_validate_cgroup_driver.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "6", + "namespace": "default", + "machineHostname": "node01", + "question": "Run a container named `logging-test` using the `nginx:alpine` image that:\n\n- Runs in detached mode\n- Configures logging driver to use the 'json-file' driver\n- Sets log rotation to keep maximum 3 files of 10m size each", + "concepts": ["docker", "logging", "configuration"], + "verification": [ + { + "id": "1", + "description": "Container is running", + "verificationScriptFile": "q6_s1_validate_container.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Container uses json-file logging driver", + "verificationScriptFile": "q6_s2_validate_log_driver.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "3", + "description": "Log rotation settings are correct", + "verificationScriptFile": "q6_s3_validate_log_rotation.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "7", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a custom bridge network named `app-network` with subnet `172.18.0.0/16`. Then run two containers:\n\n- Container `app1` using `alpine` image with network `app-network` and command to keep it running\n- Container `app2` using `alpine` image with network `app-network` and command to ping `app1` 3 times", + "concepts": ["docker", "networking", "dns"], + "verification": [ + { + "id": "1", + "description": "Custom network exists with correct subnet", + "verificationScriptFile": "q7_s1_validate_network.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Container app1 is running on app-network", + "verificationScriptFile": "q7_s2_validate_app1.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "Container app2 successfully pinged app1", + "verificationScriptFile": "q7_s3_validate_ping.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "8", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a Dockerfile in `/tmp/exam/q8/Dockerfile` that implements healthchecks for a web application:\n\n- Base image: `nginx:alpine`\n- Healthcheck should test if the server responds on port 80 using curl\n- Interval: 30 seconds\n- Timeout: 10 seconds\n- Start period: 5 seconds\n- Retries: 3\n\nThen build and run this container with name `healthy-app`.", + "concepts": ["docker", "healthchecks", "monitoring"], + "verification": [ + { + "id": "1", + "description": "Dockerfile contains HEALTHCHECK instruction", + "verificationScriptFile": "q8_s1_validate_dockerfile.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Container is running with health check", + "verificationScriptFile": "q8_s2_validate_container.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "3", + "description": "Health check parameters are correct", + "verificationScriptFile": "q8_s3_validate_health_params.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "9", + "namespace": "default", + "machineHostname": "node01", + "question": "Pull the image manifest for `nginx:1.21.0` and save it to `/tmp/exam/q9/manifest.json`. Then extract and save the list of supported platforms from this manifest to `/tmp/exam/q9/platforms.txt`.", + "concepts": ["docker", "oci", "image manifests"], + "verification": [ + { + "id": "1", + "description": "Image manifest file exists", + "verificationScriptFile": "q9_s1_validate_manifest.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Platforms file exists with correct data", + "verificationScriptFile": "q9_s2_validate_platforms.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "10", + "namespace": "default", + "machineHostname": "node01", + "question": "Run a container named `limited-resources` using the `stress` image that:\n\n- Is limited to use at maximum 0.5 CPU cores\n- Is limited to use at maximum 256MB of memory\n- Runs a CPU stress test on 1 CPU\n- Runs in detached mode", + "concepts": ["docker", "resource limits", "container constraints"], + "verification": [ + { + "id": "1", + "description": "Container is running", + "verificationScriptFile": "q10_s1_validate_running.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "CPU limit is set correctly", + "verificationScriptFile": "q10_s2_validate_cpu.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "Memory limit is set correctly", + "verificationScriptFile": "q10_s3_validate_memory.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "11", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a Docker Compose file at `/tmp/exam/q11/docker-compose.yml` that defines a simple web application with two services:\n\n- Service `web`: Using nginx:alpine, exposed on port 8080\n- Service `db`: Using postgres:13, with environment variables for database credentials\n- Define a volume for the database data\n- Define a custom network for the services\n\nThen use Docker Compose to start the services in detached mode.", + "concepts": ["docker", "docker-compose", "multi-container", "networking"], + "verification": [ + { + "id": "1", + "description": "Docker Compose file exists with correct format", + "verificationScriptFile": "q11_s1_validate_compose_file.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Services are running", + "verificationScriptFile": "q11_s2_validate_services.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "3", + "description": "Network and volume configuration is correct", + "verificationScriptFile": "q11_s3_validate_network_volume.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "12", + "namespace": "default", + "machineHostname": "node01", + "question": "Analyze the existing image `webapp:latest` and create a report in `/tmp/exam/q12/image-report.txt` that includes:\n\n- The base image used\n- Number of layers\n- The exposed ports\n- Environment variables\n- The entrypoint command", + "concepts": ["docker", "image inspection", "layers"], + "verification": [ + { + "id": "1", + "description": "Report file exists", + "verificationScriptFile": "q12_s1_validate_file.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Report contains correct base image information", + "verificationScriptFile": "q12_s2_validate_base_image.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "Report contains correct layer, port, environment, and entrypoint information", + "verificationScriptFile": "q12_s3_validate_details.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "13", + "namespace": "default", + "machineHostname": "node01", + "question": "A container named `broken-container` is running but not working correctly. Use Docker troubleshooting techniques to:\n\n- Check the container logs\n- Exec into the container to inspect files\n- Fix the issue (it's a missing file at `/app/config.json`)\n- Save your findings in `/tmp/exam/q13/diagnosis.txt`", + "concepts": ["docker", "troubleshooting", "logs", "exec"], + "verification": [ + { + "id": "1", + "description": "Diagnosis file exists", + "verificationScriptFile": "q13_s1_validate_diagnosis.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Container is fixed and working", + "verificationScriptFile": "q13_s2_validate_container_fixed.sh", + "expectedOutput": "0", + "weightage": 6 + } + ] + }, + { + "id": "14", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a Dockerfile in `/tmp/exam/q14/Dockerfile` that implements a non-root user:\n\n- Base image: `python:3.9-slim`\n- Create a user `appuser` with UID 1001\n- Set the working directory to `/app`\n- Copy a sample app.py from `/tmp/exam/q14/app.py`\n- Set the user to `appuser` before the entrypoint\n- Define the entrypoint to run the Python script\n\nBuild and run this container with the name `secure-app`.", + "concepts": ["docker", "security", "non-root user"], + "verification": [ + { + "id": "1", + "description": "Dockerfile exists with non-root user configuration", + "verificationScriptFile": "q14_s1_validate_dockerfile.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Container is running with non-root user", + "verificationScriptFile": "q14_s2_validate_container_user.sh", + "expectedOutput": "0", + "weightage": 5 + } + ] + }, + { + "id": "15", + "namespace": "default", + "machineHostname": "node01", + "question": "Optimize an existing Docker image at `/tmp/exam/q15/Dockerfile` to improve build efficiency and reduce size:\n\n- Improve the ordering of layers for better caching\n- Add appropriate `.dockerignore` file\n- Minimize the number of layers\n- Reduce the final image size\n\nBuild the optimized image with tag `optimized-app:latest`.", + "concepts": ["docker", "optimization", "caching", "layers"], + "verification": [ + { + "id": "1", + "description": "Dockerfile is optimized", + "verificationScriptFile": "q15_s1_validate_dockerfile.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Dockerignore file exists and is properly configured", + "verificationScriptFile": "q15_s2_validate_dockerignore.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "3", + "description": "Image size is reduced compared to original", + "verificationScriptFile": "q15_s3_validate_size.sh", + "expectedOutput": "0", + "weightage": 3 + } + ] + }, + { + "id": "16", + "namespace": "default", + "machineHostname": "node01", + "question": "Configure and use Docker Content Trust (DCT) to sign and verify images:\n\n- Enable Docker Content Trust\n- Pull a signed image (docker.io/library/alpine:latest)\n- Configure a passphrase for signing\n- Build, sign and push a custom image to a local registry\n\nDocument your commands in `/tmp/exam/q16/dct-commands.sh`.", + "concepts": ["docker", "security", "content trust", "signing"], + "verification": [ + { + "id": "1", + "description": "Docker Content Trust is enabled", + "verificationScriptFile": "q16_s1_validate_dct_enabled.sh", + "expectedOutput": "0", + "weightage": 3 + }, + { + "id": "2", + "description": "Command file exists with correct commands", + "verificationScriptFile": "q16_s2_validate_commands.sh", + "expectedOutput": "0", + "weightage": 5 + } + ] + } + ] +} \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/config.json b/facilitator/assets/exams/other/001/config.json new file mode 100644 index 0000000..6c1ad2e --- /dev/null +++ b/facilitator/assets/exams/other/001/config.json @@ -0,0 +1,10 @@ +{ + "lab": "docker-001", + "workerNodes": 1, + "answers": "assets/exams/other/001/answers.md", + "questions": "assessment.json", + "totalMarks": 100, + "lowScore": 40, + "mediumScore": 60, + "highScore": 90 +} \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q10_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q10_setup.sh new file mode 100644 index 0000000..d2f35cb --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q10_setup.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# Setup script for Question 10: Container resource limits + +# Remove any existing container with the same name +docker rm -f limited-resources &> /dev/null + +# Pull the stress image +docker pull progrium/stress:latest &> /dev/null || docker pull polinux/stress:latest &> /dev/null + +# If neither of the stress images are available, create a simple stress image +if [ $? -ne 0 ]; then + mkdir -p /tmp/exam/q10 + cat > /tmp/exam/q10/Dockerfile << EOF +FROM alpine:latest +RUN apk add --no-cache stress-ng +ENTRYPOINT ["stress-ng"] +EOF + docker build -t stress:latest /tmp/exam/q10 +fi + +echo "Setup for Question 10 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q11_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q11_setup.sh new file mode 100644 index 0000000..18522ad --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q11_setup.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# Setup script for Question 11: Docker Compose + +# Create directory for docker-compose file +mkdir -p /tmp/exam/q11 + +# Ensure docker-compose is installed +if ! command -v docker-compose &> /dev/null; then + echo "Installing docker-compose..." + curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose + chmod +x /usr/local/bin/docker-compose +fi + +# Pull required images +docker pull nginx:alpine &> /dev/null +docker pull postgres:13 &> /dev/null + +# Stop any existing containers from previous runs +docker-compose -f /tmp/exam/q11/docker-compose.yml down &> /dev/null + +echo "Setup for Question 11 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q12_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q12_setup.sh new file mode 100644 index 0000000..886fa30 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q12_setup.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# Setup script for Question 12: Docker image analysis + +# Create directory for output +mkdir -p /tmp/exam/q12 + +# Create a sample webapp image if not already available +if ! docker inspect webapp:latest &> /dev/null; then + # Create a temp directory + mkdir -p /tmp/exam/q12/webapp + + # Create a simple webapp + cat > /tmp/exam/q12/webapp/Dockerfile << EOF +FROM node:14-alpine +WORKDIR /app +COPY . . +RUN npm install +ENV NODE_ENV=production \ + PORT=3000 +EXPOSE 3000 +CMD ["node", "index.js"] +EOF + + # Create a package.json + cat > /tmp/exam/q12/webapp/package.json << EOF +{ + "name": "webapp", + "version": "1.0.0", + "description": "Sample web application", + "main": "index.js", + "dependencies": { + "express": "^4.17.1" + } +} +EOF + + # Create index.js + cat > /tmp/exam/q12/webapp/index.js << EOF +const express = require('express'); +const app = express(); +const port = process.env.PORT || 3000; + +app.get('/', (req, res) => { + res.send('Hello from the sample webapp!'); +}); + +app.listen(port, () => { + console.log(\`App listening at http://localhost:\${port}\`); +}); +EOF + + # Build the image + docker build -t webapp:latest /tmp/exam/q12/webapp + + # Clean up + rm -rf /tmp/exam/q12/webapp +fi + +echo "Setup for Question 12 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q13_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q13_setup.sh new file mode 100644 index 0000000..8ef24ba --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q13_setup.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# Setup script for Question 13: Docker troubleshooting + +# Create directory for output +mkdir -p /tmp/exam/q13 + +# Remove any existing container +docker rm -f broken-container &> /dev/null + +# Create a simple app that expects a config file +mkdir -p /tmp/exam/q13/app +cat > /tmp/exam/q13/app/app.js << EOF +const fs = require('fs'); +const http = require('http'); + +// Try to read the config file +try { + const config = JSON.parse(fs.readFileSync('/app/config.json', 'utf8')); + console.log('Config loaded successfully:', config); + + // Create a simple HTTP server + const server = http.createServer((req, res) => { + res.statusCode = 200; + res.setHeader('Content-Type', 'text/plain'); + res.end('App is running correctly with config: ' + JSON.stringify(config)); + }); + + server.listen(3000, () => { + console.log('Server running on port 3000'); + }); +} catch (error) { + console.error('ERROR: Failed to load config file:', error.message); + console.error('The application requires a valid /app/config.json file to run'); + process.exit(1); +} +EOF + +# Create Dockerfile +cat > /tmp/exam/q13/app/Dockerfile << EOF +FROM node:14-alpine +WORKDIR /app +COPY app.js . +# Deliberately missing config.json +CMD ["node", "app.js"] +EOF + +# Build and run the broken container +docker build -t broken-app:latest /tmp/exam/q13/app +docker run -d --name broken-container broken-app:latest + +# Clean up +rm -rf /tmp/exam/q13/app + +echo "Setup for Question 13 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q14_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q14_setup.sh new file mode 100644 index 0000000..201d427 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q14_setup.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# Setup script for Question 14: Docker non-root user + +# Create directory for app files +mkdir -p /tmp/exam/q14 + +# Create a simple Python app +cat > /tmp/exam/q14/app.py << EOF +#!/usr/bin/env python3 +import os +import time + +print("Starting secure application...") +print(f"Running as user: {os.getuid()}") + +# Display user information +try: + import pwd + user_info = pwd.getpwuid(os.getuid()) + print(f"Username: {user_info.pw_name}") + print(f"User ID: {user_info.pw_uid}") + print(f"Group ID: {user_info.pw_gid}") + print(f"Home directory: {user_info.pw_dir}") +except Exception as e: + print(f"Could not get detailed user info: {e}") + +print("Application is running securely.") + +# Keep container running for inspection +print("Container will exit in 30 seconds...") +time.sleep(30) +EOF + +# Remove any existing container or image +docker rm -f secure-app &> /dev/null +docker rmi secure-app &> /dev/null + +echo "Setup for Question 14 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q15_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q15_setup.sh new file mode 100644 index 0000000..7acecb8 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q15_setup.sh @@ -0,0 +1,100 @@ +#!/bin/bash +# Setup script for Question 15: Docker image optimization + +# Create directory for app files +mkdir -p /tmp/exam/q15 + +# Create an unoptimized Dockerfile +cat > /tmp/exam/q15/Dockerfile << EOF +FROM node:14 + +# Install dependencies separately (not optimal) +RUN npm install -g nodemon +RUN npm install -g pm2 +RUN npm install -g yarn + +# Create app directory +WORKDIR /app + +# Copy everything (not optimal) +COPY . . + +# Install dependencies (not optimal) +RUN npm install + +# Multiple ENV statements (not optimal) +ENV NODE_ENV=development +ENV PORT=3000 +ENV DEBUG=true +ENV LOG_LEVEL=debug + +# Expose port +EXPOSE 3000 + +# Run command +CMD ["npm", "start"] +EOF + +# Create package.json +cat > /tmp/exam/q15/package.json << EOF +{ + "name": "unoptimized-app", + "version": "1.0.0", + "description": "Unoptimized Docker app", + "main": "src/index.js", + "scripts": { + "start": "node src/index.js", + "dev": "nodemon src/index.js" + }, + "dependencies": { + "express": "^4.17.1", + "morgan": "^1.10.0", + "body-parser": "^1.19.0", + "cors": "^2.8.5" + }, + "devDependencies": { + "nodemon": "^2.0.12", + "jest": "^27.0.6", + "eslint": "^7.32.0" + } +} +EOF + +# Create source code +mkdir -p /tmp/exam/q15/src +cat > /tmp/exam/q15/src/index.js << EOF +const express = require('express'); +const app = express(); +const port = process.env.PORT || 3000; + +app.get('/', (req, res) => { + res.send('Hello from the unoptimized app!'); +}); + +app.listen(port, () => { + console.log(\`App listening at http://localhost:\${port}\`); +}); +EOF + +# Create some unnecessary files to ignore +cat > /tmp/exam/q15/README.md << EOF +# Unoptimized App + +This is a sample app that needs Docker optimization. +EOF + +mkdir -p /tmp/exam/q15/tests +cat > /tmp/exam/q15/tests/test.js << EOF +console.log('This is a test file that should be excluded from the image'); +EOF + +mkdir -p /tmp/exam/q15/logs +cat > /tmp/exam/q15/logs/app.log << EOF +Sample log entry that should be excluded from the image +EOF + +# Remove any existing image +docker rmi optimized-app:latest &> /dev/null + +echo "Setup for Question 15 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q16_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q16_setup.sh new file mode 100644 index 0000000..ddc690a --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q16_setup.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# Setup script for Question 16: Docker Content Trust + +# Create directory for command file +mkdir -p /tmp/exam/q16 + +# Set up a local registry if not already running +if ! docker ps | grep -q registry; then + echo "Setting up local registry..." + docker run -d -p 5000:5000 --name registry registry:2 +fi + +# Ensure any old DCT settings are cleared +export DOCKER_CONTENT_TRUST=0 + +# Ensure directory for notary exists +mkdir -p ~/.docker/trust + +# Create a simple app for signing +mkdir -p /tmp/exam/q16/secure-app +cat > /tmp/exam/q16/secure-app/Dockerfile << EOF +FROM alpine:latest +CMD ["echo", "This is a signed secure image"] +EOF + +# Remove any existing files +rm -f /tmp/exam/q16/dct-commands.sh + +echo "Setup for Question 16 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q1_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q1_setup.sh new file mode 100644 index 0000000..f389959 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q1_setup.sh @@ -0,0 +1,26 @@ +#!/bin/bash +# Setup script for Question 1: Docker image creation + +# Create necessary directories +mkdir -p /tmp/exam/q1 + +# Create a simple Dockerfile +cat > /tmp/exam/q1/Dockerfile << EOF +FROM alpine:latest +WORKDIR /app +COPY hello.sh . +RUN chmod +x hello.sh +CMD ["./hello.sh"] +EOF + +# Create the hello script +cat > /tmp/exam/q1/hello.sh << EOF +#!/bin/sh +echo "Hello from Docker Speed Run!" +EOF + +# Make it executable +chmod +x /tmp/exam/q1/hello.sh + +echo "Setup for Question 1 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q2_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q2_setup.sh new file mode 100644 index 0000000..0c3e885 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q2_setup.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# Setup script for Question 2: Docker container with port mapping and environment variables + +# Ensure nginx:alpine image is available +docker pull nginx:alpine &> /dev/null + +# Remove any existing container with the same name +docker rm -f web-server &> /dev/null + +echo "Setup for Question 2 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q3_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q3_setup.sh new file mode 100644 index 0000000..0b18bda --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q3_setup.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Setup script for Question 3: Docker volumes + +# Remove any existing volume with the same name +docker volume rm data-volume &> /dev/null + +# Remove any existing container with the same name +docker rm -f volume-test &> /dev/null + +# Pull the alpine image +docker pull alpine:latest &> /dev/null + +echo "Setup for Question 3 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q4_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q4_setup.sh new file mode 100644 index 0000000..1eed9fb --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q4_setup.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# Setup script for Question 4: Multi-stage Docker build + +# Create necessary directories +mkdir -p /tmp/exam/q4 + +# Create a simple Go application +cat > /tmp/exam/q4/main.go << EOF +package main + +import ( + "fmt" + "net/http" +) + +func main() { + http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { + fmt.Fprintf(w, "Hello from Multi-Stage Docker Build!") + }) + + fmt.Println("Server starting on port 8080...") + http.ListenAndServe(":8080", nil) +} +EOF + +# Remove any existing image with the same name +docker rmi multi-stage:latest &> /dev/null + +echo "Setup for Question 4 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q5_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q5_setup.sh new file mode 100644 index 0000000..b2ace17 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q5_setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# Setup script for Question 5: Docker daemon configuration + +# Backup original daemon.json if it exists +if [ -f /etc/docker/daemon.json ]; then + cp /etc/docker/daemon.json /etc/docker/daemon.json.backup +else + # Create empty daemon.json + mkdir -p /etc/docker + echo "{}" > /etc/docker/daemon.json +fi + +# Create a reference file with expected content +mkdir -p /tmp/exam/q5 +cat > /tmp/exam/q5/reference.json << EOF +{ + "exec-opts": ["native.cgroupdriver=systemd"], + "log-driver": "json-file", + "log-opts": { + "max-size": "100m" + }, + "storage-driver": "overlay2" +} +EOF + +echo "Setup for Question 5 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q6_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q6_setup.sh new file mode 100644 index 0000000..f772936 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q6_setup.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# Setup script for Question 6: Docker logging configuration + +# Ensure nginx:alpine image is available +docker pull nginx:alpine &> /dev/null + +# Remove any existing container with the same name +docker rm -f logging-test &> /dev/null + +echo "Setup for Question 6 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q7_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q7_setup.sh new file mode 100644 index 0000000..2f968d0 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q7_setup.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Setup script for Question 7: Docker networking + +# Remove any existing network with the same name +docker network rm app-network &> /dev/null + +# Remove any existing containers +docker rm -f app1 app2 &> /dev/null + +# Ensure alpine image is available +docker pull alpine:latest &> /dev/null + +echo "Setup for Question 7 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q8_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q8_setup.sh new file mode 100644 index 0000000..dbe0b49 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q8_setup.sh @@ -0,0 +1,15 @@ +#!/bin/bash +# Setup script for Question 8: Docker healthchecks + +# Create directory for Dockerfile +mkdir -p /tmp/exam/q8 + +# Remove any existing container and image +docker rm -f healthy-app &> /dev/null +docker rmi healthy-nginx &> /dev/null + +# Ensure nginx:alpine image is available +docker pull nginx:alpine &> /dev/null + +echo "Setup for Question 8 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/setup/q9_setup.sh b/facilitator/assets/exams/other/001/scripts/setup/q9_setup.sh new file mode 100644 index 0000000..d3f261c --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/setup/q9_setup.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Setup script for Question 9: Docker image manifests + +# Create directory for output +mkdir -p /tmp/exam/q9 + +# Ensure we have access to the manifest command +export DOCKER_CLI_EXPERIMENTAL=enabled + +# Clean up any existing files +rm -f /tmp/exam/q9/manifest.json /tmp/exam/q9/platforms.txt + +echo "Setup for Question 9 complete." +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q10_s1_validate_running.sh b/facilitator/assets/exams/other/001/scripts/validation/q10_s1_validate_running.sh new file mode 100644 index 0000000..fced504 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q10_s1_validate_running.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# Validate script for Question 10, Step 1: Check if limited-resources container is running + +# Check if the container exists and is running +docker inspect --format='{{.State.Running}}' limited-resources &> /dev/null + +if [ $? -eq 0 ]; then + running=$(docker inspect --format='{{.State.Running}}' limited-resources) + if [ "$running" == "true" ]; then + echo "✅ Container 'limited-resources' is running" + exit 0 + else + echo "❌ Container 'limited-resources' exists but is not running" + exit 1 + fi +else + echo "❌ Container 'limited-resources' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q10_s2_validate_cpu.sh b/facilitator/assets/exams/other/001/scripts/validation/q10_s2_validate_cpu.sh new file mode 100644 index 0000000..32820f3 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q10_s2_validate_cpu.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 10, Step 2: Check if CPU limit is set correctly + +# Check if the container exists +docker inspect limited-resources &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'limited-resources' does not exist" + exit 1 +fi + +# Get the CPU limit (NanoCPUs is in billionths of a CPU, so 0.5 CPU = 500000000) +nano_cpus=$(docker inspect --format='{{.HostConfig.NanoCpus}}' limited-resources) +cpus=$(echo "scale=2; $nano_cpus / 1000000000" | bc) + +# Check if it's set to 0.5 CPU +if (( $(echo "$cpus >= 0.49 && $cpus <= 0.51" | bc -l) )); then + echo "✅ Container CPU limit is set correctly: $cpus CPUs" + exit 0 +else + echo "❌ Container CPU limit is not set to 0.5 CPUs: $cpus CPUs" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q10_s3_validate_memory.sh b/facilitator/assets/exams/other/001/scripts/validation/q10_s3_validate_memory.sh new file mode 100644 index 0000000..6a05bc2 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q10_s3_validate_memory.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 10, Step 3: Check if memory limit is set correctly + +# Check if the container exists +docker inspect limited-resources &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'limited-resources' does not exist" + exit 1 +fi + +# Get the memory limit in bytes +memory_bytes=$(docker inspect --format='{{.HostConfig.Memory}}' limited-resources) +memory_mb=$(( memory_bytes / 1024 / 1024 )) + +# Check if it's set to 256MB (allow a small tolerance) +if [[ "$memory_mb" -ge 255 && "$memory_mb" -le 257 ]]; then + echo "✅ Container memory limit is set correctly: ${memory_mb}MB" + exit 0 +else + echo "❌ Container memory limit is not set to 256MB: ${memory_mb}MB" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q11_s1_validate_compose_file.sh b/facilitator/assets/exams/other/001/scripts/validation/q11_s1_validate_compose_file.sh new file mode 100644 index 0000000..bfceb82 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q11_s1_validate_compose_file.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# Validate script for Question 11, Step 1: Check if Docker Compose file exists and has correct format + +# Check if the compose file exists +if [ ! -f /tmp/exam/q11/docker-compose.yml ]; then + echo "❌ Docker Compose file does not exist at /tmp/exam/q11/docker-compose.yml" + exit 1 +fi + +# Check basic structure of the compose file +grep -q "^version:" /tmp/exam/q11/docker-compose.yml +if [ $? -ne 0 ]; then + echo "❌ Docker Compose file is missing version field" + exit 1 +fi + +grep -q "^services:" /tmp/exam/q11/docker-compose.yml +if [ $? -ne 0 ]; then + echo "❌ Docker Compose file is missing services section" + exit 1 +fi + +# Check for required services +grep -q " web:" /tmp/exam/q11/docker-compose.yml +if [ $? -ne 0 ]; then + echo "❌ Docker Compose file is missing 'web' service" + exit 1 +fi + +grep -q " db:" /tmp/exam/q11/docker-compose.yml +if [ $? -ne 0 ]; then + echo "❌ Docker Compose file is missing 'db' service" + exit 1 +fi + +echo "✅ Docker Compose file exists with correct basic structure" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q11_s2_validate_services.sh b/facilitator/assets/exams/other/001/scripts/validation/q11_s2_validate_services.sh new file mode 100644 index 0000000..cbd1616 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q11_s2_validate_services.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# Validate script for Question 11, Step 2: Check if services are running + +# Check if docker-compose is available +if ! command -v docker-compose &> /dev/null; then + echo "❌ docker-compose command not found" + exit 1 +fi + +# Check if the compose file exists +if [ ! -f /tmp/exam/q11/docker-compose.yml ]; then + echo "❌ Docker Compose file does not exist at /tmp/exam/q11/docker-compose.yml" + exit 1 +fi + +# Change to the directory with the docker-compose file +cd /tmp/exam/q11 + +# Check if the services are running +docker-compose ps --services --filter "status=running" | grep -q "web" +web_running=$? + +docker-compose ps --services --filter "status=running" | grep -q "db" +db_running=$? + +if [ $web_running -eq 0 ] && [ $db_running -eq 0 ]; then + echo "✅ Both 'web' and 'db' services are running" + exit 0 +elif [ $web_running -eq 0 ]; then + echo "❌ 'web' service is running but 'db' service is not" + exit 1 +elif [ $db_running -eq 0 ]; then + echo "❌ 'db' service is running but 'web' service is not" + exit 1 +else + echo "❌ Neither 'web' nor 'db' services are running" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q11_s3_validate_network_volume.sh b/facilitator/assets/exams/other/001/scripts/validation/q11_s3_validate_network_volume.sh new file mode 100644 index 0000000..7af95ad --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q11_s3_validate_network_volume.sh @@ -0,0 +1,48 @@ +#!/bin/bash +# Validate script for Question 11, Step 3: Check if network and volume configuration is correct + +# Check if the compose file exists +if [ ! -f /tmp/exam/q11/docker-compose.yml ]; then + echo "❌ Docker Compose file does not exist at /tmp/exam/q11/docker-compose.yml" + exit 1 +fi + +# Change to the directory with the docker-compose file +cd /tmp/exam/q11 + +# Check if a custom network is defined +grep -q "^networks:" docker-compose.yml +if [ $? -ne 0 ]; then + echo "❌ Docker Compose file does not define networks section" + exit 1 +fi + +# Check if a volume is defined +grep -q "^volumes:" docker-compose.yml +if [ $? -ne 0 ]; then + echo "❌ Docker Compose file does not define volumes section" + exit 1 +fi + +# Check if the web service is using the network +grep -E -A10 "^ web:" docker-compose.yml | grep -q "networks:" +if [ $? -ne 0 ]; then + echo "❌ Web service is not configured to use the custom network" + exit 1 +fi + +# Check if the db service is using the network and volume +grep -E -A20 "^ db:" docker-compose.yml | grep -q "networks:" +if [ $? -ne 0 ]; then + echo "❌ DB service is not configured to use the custom network" + exit 1 +fi + +grep -E -A20 "^ db:" docker-compose.yml | grep -q "volumes:" +if [ $? -ne 0 ]; then + echo "❌ DB service is not configured to use a volume" + exit 1 +fi + +echo "✅ Docker Compose file has correct network and volume configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q12_s1_validate_file.sh b/facilitator/assets/exams/other/001/scripts/validation/q12_s1_validate_file.sh new file mode 100644 index 0000000..f121a50 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q12_s1_validate_file.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# Validate script for Question 12, Step 1: Check if report file exists + +# Check if the report file exists +if [ ! -f /tmp/exam/q12/image-report.txt ]; then + echo "❌ Image report file does not exist at /tmp/exam/q12/image-report.txt" + exit 1 +fi + +# Check if the report file has content +if [ ! -s /tmp/exam/q12/image-report.txt ]; then + echo "❌ Image report file exists but is empty" + exit 1 +fi + +echo "✅ Image report file exists and has content" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q12_s2_validate_base_image.sh b/facilitator/assets/exams/other/001/scripts/validation/q12_s2_validate_base_image.sh new file mode 100644 index 0000000..291b5c7 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q12_s2_validate_base_image.sh @@ -0,0 +1,28 @@ +#!/bin/bash +# Validate script for Question 12, Step 2: Check if report contains correct base image information + +# Check if the report file exists +if [ ! -f /tmp/exam/q12/image-report.txt ]; then + echo "❌ Image report file does not exist at /tmp/exam/q12/image-report.txt" + exit 1 +fi + +# Check if the report contains base image information +grep -i "base image\|from\|parent" /tmp/exam/q12/image-report.txt + +if [ $? -eq 0 ]; then + # Get the actual base image for comparison + base_image=$(docker inspect webapp:latest --format='{{.Config.Image}}' 2>/dev/null || docker history webapp:latest | tail -1 | awk '{print $1}') + + if [[ -n "$base_image" ]]; then + echo "✅ Report contains base image information" + exit 0 + else + echo "✅ Report contains some base image information but we couldn't verify it" + exit 0 + fi +else + echo "❌ Report does not contain base image information" + echo "Expected information about 'Base Image' or similar" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q12_s3_validate_details.sh b/facilitator/assets/exams/other/001/scripts/validation/q12_s3_validate_details.sh new file mode 100644 index 0000000..fb4e0c0 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q12_s3_validate_details.sh @@ -0,0 +1,53 @@ +#!/bin/bash +# Validate script for Question 12, Step 3: Check if report contains all required details + +# Check if the report file exists +if [ ! -f /tmp/exam/q12/image-report.txt ]; then + echo "❌ Image report file does not exist at /tmp/exam/q12/image-report.txt" + exit 1 +fi + +# Initialize a score +score=0 +total_checks=4 + +# Check for layers information +if grep -i "layers\|layer" /tmp/exam/q12/image-report.txt > /dev/null; then + echo "✅ Report contains information about layers" + ((score++)) +else + echo "❌ Report is missing information about the number of layers" +fi + +# Check for ports information +if grep -i "port\|expose" /tmp/exam/q12/image-report.txt > /dev/null; then + echo "✅ Report contains information about exposed ports" + ((score++)) +else + echo "❌ Report is missing information about exposed ports" +fi + +# Check for environment variables +if grep -i "environment\|env" /tmp/exam/q12/image-report.txt > /dev/null; then + echo "✅ Report contains information about environment variables" + ((score++)) +else + echo "❌ Report is missing information about environment variables" +fi + +# Check for entrypoint +if grep -i "entrypoint\|cmd\|command" /tmp/exam/q12/image-report.txt > /dev/null; then + echo "✅ Report contains information about entrypoint/command" + ((score++)) +else + echo "❌ Report is missing information about entrypoint/command" +fi + +# Check overall score (require at least 3 of 4 checks to pass) +if [ $score -ge 3 ]; then + echo "✅ Report contains most of the required information ($score/$total_checks checks passed)" + exit 0 +else + echo "❌ Report is missing too much required information (only $score/$total_checks checks passed)" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q13_s1_validate_diagnosis.sh b/facilitator/assets/exams/other/001/scripts/validation/q13_s1_validate_diagnosis.sh new file mode 100644 index 0000000..1c7127f --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q13_s1_validate_diagnosis.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# Validate script for Question 13, Step 1: Check if diagnosis file exists + +# Check if the diagnosis file exists +if [ ! -f /tmp/exam/q13/diagnosis.txt ]; then + echo "❌ Diagnosis file does not exist at /tmp/exam/q13/diagnosis.txt" + exit 1 +fi + +# Check if the diagnosis file has content +if [ ! -s /tmp/exam/q13/diagnosis.txt ]; then + echo "❌ Diagnosis file exists but is empty" + exit 1 +fi + +# Check if the diagnosis file mentions the config.json file that's missing +if grep -q "config.json\|configuration" /tmp/exam/q13/diagnosis.txt; then + echo "✅ Diagnosis file mentions the missing configuration file" + exit 0 +else + echo "❌ Diagnosis file does not mention the missing config.json file" + echo "Content:" + cat /tmp/exam/q13/diagnosis.txt + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q13_s2_validate_container_fixed.sh b/facilitator/assets/exams/other/001/scripts/validation/q13_s2_validate_container_fixed.sh new file mode 100644 index 0000000..4602d66 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q13_s2_validate_container_fixed.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# Validate script for Question 13, Step 2: Check if container is fixed and working + +# Check if the container exists +docker inspect broken-container &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'broken-container' does not exist" + exit 1 +fi + +# Get container status +status=$(docker inspect --format='{{.State.Status}}' broken-container) + +# Check if container is running +if [ "$status" != "running" ]; then + echo "❌ Container 'broken-container' is not running (status: $status)" + exit 1 +fi + +# Check if the config.json file was created +config_exists=$(docker exec broken-container ls -la /app/config.json 2>/dev/null) + +if [ $? -ne 0 ]; then + echo "❌ Container is running but the config file /app/config.json does not exist" + exit 1 +fi + +# Check if the config.json file has valid JSON content +json_valid=$(docker exec broken-container sh -c 'cat /app/config.json | grep -o "{.*}" | wc -l') + +if [ "$json_valid" -ge 1 ]; then + echo "✅ Container is fixed and running with a valid config.json file" + exit 0 +else + echo "❌ Container has a config.json file but it may not have valid JSON content" + echo "Content: $(docker exec broken-container cat /app/config.json 2>/dev/null)" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q14_s1_validate_dockerfile.sh b/facilitator/assets/exams/other/001/scripts/validation/q14_s1_validate_dockerfile.sh new file mode 100644 index 0000000..c05e309 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q14_s1_validate_dockerfile.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Validate script for Question 14, Step 1: Check if Dockerfile exists with non-root user configuration + +# Check if the Dockerfile exists +if [ ! -f /tmp/exam/q14/Dockerfile ]; then + echo "❌ Dockerfile does not exist at /tmp/exam/q14/Dockerfile" + exit 1 +fi + +# Check if the Dockerfile has USER instruction +grep -q "USER" /tmp/exam/q14/Dockerfile + +if [ $? -ne 0 ]; then + echo "❌ Dockerfile does not contain USER instruction" + exit 1 +fi + +# Check if the USER is set to appuser +grep -q "USER.*appuser" /tmp/exam/q14/Dockerfile + +if [ $? -ne 0 ]; then + echo "❌ Dockerfile does not set USER to 'appuser'" + exit 1 +fi + +# Check for user creation with UID 1001 +grep -q "useradd.*1001" /tmp/exam/q14/Dockerfile || grep -q "adduser.*1001" /tmp/exam/q14/Dockerfile + +if [ $? -ne 0 ]; then + echo "❌ Dockerfile does not create a user with UID 1001" + exit 1 +fi + +echo "✅ Dockerfile exists with non-root user configuration" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q14_s2_validate_container_user.sh b/facilitator/assets/exams/other/001/scripts/validation/q14_s2_validate_container_user.sh new file mode 100644 index 0000000..44b90b5 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q14_s2_validate_container_user.sh @@ -0,0 +1,46 @@ +#!/bin/bash +# Validate script for Question 14, Step 2: Check if container is running with non-root user + +# Check if the container exists and is running +docker inspect secure-app &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'secure-app' does not exist" + exit 1 +fi + +# Get container status +status=$(docker inspect --format='{{.State.Status}}' secure-app) + +# Check if container is running or exited successfully +if [[ "$status" != "running" && "$status" != "exited" ]]; then + echo "❌ Container 'secure-app' is not running or did not exit successfully (status: $status)" + exit 1 +fi + +# Get the user that the container is running as +user_id=$(docker inspect --format='{{.Config.User}}' secure-app) + +# If the user ID is numeric, check if it's not 0 (root) +if [[ "$user_id" =~ ^[0-9]+$ ]]; then + if [ "$user_id" -eq 0 ]; then + echo "❌ Container is running as root user (UID 0)" + exit 1 + else + echo "✅ Container is running with non-root user, UID: $user_id" + exit 0 + fi +# If the user ID is a name, check if it's not root +elif [[ "$user_id" == "root" ]]; then + echo "❌ Container is running as 'root' user" + exit 1 +elif [[ "$user_id" == "appuser" || "$user_id" == *":appuser"* || "$user_id" == "appuser:"* ]]; then + echo "✅ Container is running as 'appuser'" + exit 0 +elif [[ -z "$user_id" ]]; then + echo "❌ No user specified in container configuration (defaults to root)" + exit 1 +else + echo "✅ Container is running with non-root user: $user_id" + exit 0 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q1_s1_validate_image_v1.sh b/facilitator/assets/exams/other/001/scripts/validation/q1_s1_validate_image_v1.sh new file mode 100644 index 0000000..c03e7a7 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q1_s1_validate_image_v1.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# Validate script for Question 1, Step 1: Check if docker-speedrun:v1 image exists + +# Check if the image exists +docker image inspect docker-speedrun:v1 &> /dev/null + +if [ $? -eq 0 ]; then + echo "✅ Image 'docker-speedrun:v1' exists" + exit 0 +else + echo "❌ Image 'docker-speedrun:v1' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q1_s2_validate_image_latest.sh b/facilitator/assets/exams/other/001/scripts/validation/q1_s2_validate_image_latest.sh new file mode 100644 index 0000000..3956314 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q1_s2_validate_image_latest.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# Validate script for Question 1, Step 2: Check if docker-speedrun:latest image exists + +# Check if the image exists +docker image inspect docker-speedrun:latest &> /dev/null + +if [ $? -eq 0 ]; then + echo "✅ Image 'docker-speedrun:latest' exists" + exit 0 +else + echo "❌ Image 'docker-speedrun:latest' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q2_s1_validate_container_running.sh b/facilitator/assets/exams/other/001/scripts/validation/q2_s1_validate_container_running.sh new file mode 100644 index 0000000..2c3063e --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q2_s1_validate_container_running.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# Validate script for Question 2, Step 1: Check if container is running + +# Check if the container exists and is running +docker inspect --format='{{.State.Running}}' web-server &> /dev/null + +if [ $? -eq 0 ]; then + running=$(docker inspect --format='{{.State.Running}}' web-server) + if [ "$running" == "true" ]; then + echo "✅ Container 'web-server' is running" + exit 0 + else + echo "❌ Container 'web-server' exists but is not running" + exit 1 + fi +else + echo "❌ Container 'web-server' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q2_s2_validate_image.sh b/facilitator/assets/exams/other/001/scripts/validation/q2_s2_validate_image.sh new file mode 100644 index 0000000..9663b9f --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q2_s2_validate_image.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# Validate script for Question 2, Step 2: Check if container uses the correct image + +# Check if the container exists +docker inspect web-server &> /dev/null + +if [ $? -eq 0 ]; then + # Get the image name + image=$(docker inspect --format='{{.Config.Image}}' web-server) + + # Check if it's using nginx:alpine + if [[ "$image" == "nginx:alpine" ]]; then + echo "✅ Container 'web-server' is using the correct image: $image" + exit 0 + else + echo "❌ Container 'web-server' is using incorrect image: $image (expected: nginx:alpine)" + exit 1 + fi +else + echo "❌ Container 'web-server' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q2_s3_validate_port.sh b/facilitator/assets/exams/other/001/scripts/validation/q2_s3_validate_port.sh new file mode 100644 index 0000000..6ac14f4 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q2_s3_validate_port.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 2, Step 3: Check if port mapping is correct + +# Check if the container exists +docker inspect web-server &> /dev/null + +if [ $? -eq 0 ]; then + # Get the port mappings + port_mappings=$(docker inspect --format='{{json .HostConfig.PortBindings}}' web-server) + + # Check if port 8080 is mapped to 80 + if [[ $port_mappings == *"8080"* && $port_mappings == *"80"* ]]; then + echo "✅ Container 'web-server' has correct port mapping (8080->80)" + exit 0 + else + echo "❌ Container 'web-server' does not have correct port mapping (expected: 8080->80)" + echo "Current port mappings: $port_mappings" + exit 1 + fi +else + echo "❌ Container 'web-server' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q2_s4_validate_env.sh b/facilitator/assets/exams/other/001/scripts/validation/q2_s4_validate_env.sh new file mode 100644 index 0000000..f107c1c --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q2_s4_validate_env.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 2, Step 4: Check if environment variable is set correctly + +# Check if the container exists +docker inspect web-server &> /dev/null + +if [ $? -eq 0 ]; then + # Check if the environment variable is set + env_var=$(docker exec web-server env | grep NGINX_HOST) + + if [[ "$env_var" == "NGINX_HOST=localhost" ]]; then + echo "✅ Container 'web-server' has correct environment variable set: $env_var" + exit 0 + else + echo "❌ Container 'web-server' does not have correct environment variable" + echo "Expected: NGINX_HOST=localhost" + echo "Found: $env_var" + exit 1 + fi +else + echo "❌ Container 'web-server' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q3_s1_validate_volume.sh b/facilitator/assets/exams/other/001/scripts/validation/q3_s1_validate_volume.sh new file mode 100644 index 0000000..c4e7274 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q3_s1_validate_volume.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# Validate script for Question 3, Step 1: Check if volume exists + +# Check if the volume exists +docker volume inspect data-volume &> /dev/null + +if [ $? -eq 0 ]; then + echo "✅ Volume 'data-volume' exists" + exit 0 +else + echo "❌ Volume 'data-volume' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q3_s2_validate_container_mount.sh b/facilitator/assets/exams/other/001/scripts/validation/q3_s2_validate_container_mount.sh new file mode 100644 index 0000000..a28e368 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q3_s2_validate_container_mount.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 3, Step 2: Check if container was created with correct mount + +# Check if the container exists or existed +docker inspect volume-test &> /dev/null + +if [ $? -eq 0 ]; then + # Get mount information + mount_info=$(docker inspect --format='{{json .Mounts}}' volume-test) + + # Check if the volume is mounted at the correct path + if [[ $mount_info == *"data-volume"* && $mount_info == *"/app/data"* ]]; then + echo "✅ Container 'volume-test' was created with the correct mount" + exit 0 + else + echo "❌ Container 'volume-test' does not have correct volume mount" + echo "Current mounts: $mount_info" + exit 1 + fi +else + echo "❌ Container 'volume-test' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q3_s3_validate_file_content.sh b/facilitator/assets/exams/other/001/scripts/validation/q3_s3_validate_file_content.sh new file mode 100644 index 0000000..589e015 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q3_s3_validate_file_content.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Validate script for Question 3, Step 3: Check if file exists in the volume with correct content + +# Check if the volume exists +docker volume inspect data-volume &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Volume 'data-volume' does not exist" + exit 1 +fi + +# Create a temporary container to check the volume content +file_content=$(docker run --rm -v data-volume:/app/data alpine:latest cat /app/data/test.txt 2>/dev/null) + +if [ $? -eq 0 ]; then + # Check if the file content is correct + if [[ "$file_content" == "Docker volumes test" ]]; then + echo "✅ File '/app/data/test.txt' exists in the volume with correct content" + exit 0 + else + echo "❌ File exists but has incorrect content" + echo "Expected: 'Docker volumes test'" + echo "Found: '$file_content'" + exit 1 + fi +else + echo "❌ File '/app/data/test.txt' does not exist in the volume" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q4_s1_validate_dockerfile.sh b/facilitator/assets/exams/other/001/scripts/validation/q4_s1_validate_dockerfile.sh new file mode 100644 index 0000000..69387dd --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q4_s1_validate_dockerfile.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# Validate script for Question 4, Step 1: Check if Dockerfile exists and has multiple stages + +# Check if the Dockerfile exists +if [ ! -f /tmp/exam/q4/Dockerfile ]; then + echo "❌ Dockerfile does not exist at /tmp/exam/q4/Dockerfile" + exit 1 +fi + +# Check if the Dockerfile has multiple stages +stages=$(grep -c "FROM" /tmp/exam/q4/Dockerfile) + +if [ "$stages" -ge 2 ]; then + echo "✅ Dockerfile exists and has multiple stages ($stages stages detected)" + exit 0 +else + echo "❌ Dockerfile does not have multiple stages (found $stages FROM statements, need at least 2)" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q4_s2_validate_image_built.sh b/facilitator/assets/exams/other/001/scripts/validation/q4_s2_validate_image_built.sh new file mode 100644 index 0000000..4c63515 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q4_s2_validate_image_built.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Validate script for Question 4, Step 2: Check if image was built successfully + +# Check if the image exists +docker image inspect multi-stage:latest &> /dev/null + +if [ $? -eq 0 ]; then + echo "✅ Image 'multi-stage:latest' exists" + exit 0 +else + echo "❌ Image 'multi-stage:latest' does not exist" + exit 1 +fi + \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q4_s3_validate_image_size.sh b/facilitator/assets/exams/other/001/scripts/validation/q4_s3_validate_image_size.sh new file mode 100644 index 0000000..077f0f2 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q4_s3_validate_image_size.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 4, Step 3: Check if image size is optimized + +# Check if the image exists +docker image inspect multi-stage:latest &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Image 'multi-stage:latest' does not exist" + exit 1 +fi + +# Get the image size in MB +image_size=$(docker image inspect multi-stage:latest --format='{{.Size}}') +image_size_mb=$(echo "scale=2; $image_size / 1024 / 1024" | bc) + +# Check if the image size is less than 20MB +if (( $(echo "$image_size_mb < 20" | bc -l) )); then + echo "✅ Image size is optimized: ${image_size_mb}MB (less than 20MB)" + exit 0 +else + echo "❌ Image size is not optimized: ${image_size_mb}MB (expected: less than 20MB)" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q5_s1_validate_daemon_config.sh b/facilitator/assets/exams/other/001/scripts/validation/q5_s1_validate_daemon_config.sh new file mode 100644 index 0000000..56e7e79 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q5_s1_validate_daemon_config.sh @@ -0,0 +1,21 @@ +#!/bin/bash +# Validate script for Question 5, Step 1: Check if Docker daemon configuration has correct settings + +# Check if daemon.json exists +if [ ! -f /etc/docker/daemon.json ]; then + echo "❌ Docker daemon configuration file does not exist at /etc/docker/daemon.json" + exit 1 +fi + +# Check for systemd cgroup driver in the configuration +grep -q "native.cgroupdriver=systemd" /etc/docker/daemon.json + +if [ $? -eq 0 ]; then + echo "✅ Docker daemon is configured with systemd cgroup driver" + exit 0 +else + echo "❌ Docker daemon is not configured with systemd cgroup driver" + echo "Current configuration:" + cat /etc/docker/daemon.json + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q5_s2_validate_cgroup_driver.sh b/facilitator/assets/exams/other/001/scripts/validation/q5_s2_validate_cgroup_driver.sh new file mode 100644 index 0000000..49333bf --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q5_s2_validate_cgroup_driver.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# Validate script for Question 5, Step 2: Check if Docker service is running with systemd cgroup driver + +# Check if Docker service is running +systemctl is-active docker &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Docker service is not running" + exit 1 +fi + +# Check for systemd cgroup driver in Docker info +docker info | grep -q "Cgroup Driver: systemd" + +if [ $? -eq 0 ]; then + echo "✅ Docker service is running with systemd cgroup driver" + exit 0 +else + echo "❌ Docker service is not using systemd cgroup driver" + echo "Current configuration:" + docker info | grep "Cgroup Driver" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q6_s1_validate_container.sh b/facilitator/assets/exams/other/001/scripts/validation/q6_s1_validate_container.sh new file mode 100644 index 0000000..3f160ca --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q6_s1_validate_container.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# Validate script for Question 6, Step 1: Check if logging-test container is running + +# Check if the container exists and is running +docker inspect --format='{{.State.Running}}' logging-test &> /dev/null + +if [ $? -eq 0 ]; then + running=$(docker inspect --format='{{.State.Running}}' logging-test) + if [ "$running" == "true" ]; then + echo "✅ Container 'logging-test' is running" + exit 0 + else + echo "❌ Container 'logging-test' exists but is not running" + exit 1 + fi +else + echo "❌ Container 'logging-test' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q6_s2_validate_log_driver.sh b/facilitator/assets/exams/other/001/scripts/validation/q6_s2_validate_log_driver.sh new file mode 100644 index 0000000..80c5d99 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q6_s2_validate_log_driver.sh @@ -0,0 +1,21 @@ +#!/bin/bash +# Validate script for Question 6, Step 2: Check if container uses json-file logging driver + +# Check if the container exists +docker inspect logging-test &> /dev/null + +if [ $? -eq 0 ]; then + # Get the logging driver + log_driver=$(docker inspect --format='{{.HostConfig.LogConfig.Type}}' logging-test) + + if [[ "$log_driver" == "json-file" ]]; then + echo "✅ Container 'logging-test' is using the json-file logging driver" + exit 0 + else + echo "❌ Container 'logging-test' is using incorrect logging driver: $log_driver (expected: json-file)" + exit 1 + fi +else + echo "❌ Container 'logging-test' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q6_s3_validate_log_rotation.sh b/facilitator/assets/exams/other/001/scripts/validation/q6_s3_validate_log_rotation.sh new file mode 100644 index 0000000..bfd3081 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q6_s3_validate_log_rotation.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# Validate script for Question 6, Step 3: Check if log rotation settings are correct + +# Check if the container exists +docker inspect logging-test &> /dev/null + +if [ $? -eq 0 ]; then + # Get the log config options + log_opts=$(docker inspect --format='{{json .HostConfig.LogConfig.Config}}' logging-test) + + # Check for log rotation settings + max_size=$(echo $log_opts | grep -o '"max-size":"[^"]*"' | cut -d':' -f2 | tr -d '"') + max_file=$(echo $log_opts | grep -o '"max-file":"[^"]*"' | cut -d':' -f2 | tr -d '"') + + if [[ "$max_size" == "10m" && "$max_file" == "3" ]]; then + echo "✅ Container 'logging-test' has correct log rotation settings: max-size=$max_size, max-file=$max_file" + exit 0 + else + echo "❌ Container 'logging-test' does not have correct log rotation settings" + echo "Expected: max-size=10m, max-file=3" + echo "Found: max-size=$max_size, max-file=$max_file" + exit 1 + fi +else + echo "❌ Container 'logging-test' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q7_s1_validate_network.sh b/facilitator/assets/exams/other/001/scripts/validation/q7_s1_validate_network.sh new file mode 100644 index 0000000..30d58e3 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q7_s1_validate_network.sh @@ -0,0 +1,21 @@ +#!/bin/bash +# Validate script for Question 7, Step 1: Check if custom network exists with correct subnet + +# Check if the network exists +docker network inspect app-network &> /dev/null + +if [ $? -eq 0 ]; then + # Get subnet information + subnet=$(docker network inspect --format='{{range .IPAM.Config}}{{.Subnet}}{{end}}' app-network) + + if [[ "$subnet" == "172.18.0.0/16" ]]; then + echo "✅ Network 'app-network' exists with correct subnet: $subnet" + exit 0 + else + echo "❌ Network 'app-network' exists but has incorrect subnet: $subnet (expected: 172.18.0.0/16)" + exit 1 + fi +else + echo "❌ Network 'app-network' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q7_s2_validate_app1.sh b/facilitator/assets/exams/other/001/scripts/validation/q7_s2_validate_app1.sh new file mode 100644 index 0000000..b19ba47 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q7_s2_validate_app1.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# Validate script for Question 7, Step 2: Check if app1 container is running on app-network + +# Check if the container exists +docker inspect app1 &> /dev/null + +if [ $? -eq 0 ]; then + # Check if it's running + running=$(docker inspect --format='{{.State.Running}}' app1) + + if [ "$running" != "true" ]; then + echo "❌ Container 'app1' exists but is not running" + exit 1 + fi + + # Check if it's on the app-network + network=$(docker inspect --format='{{json .NetworkSettings.Networks}}' app1) + + if [[ $network == *"app-network"* ]]; then + echo "✅ Container 'app1' is running on 'app-network'" + exit 0 + else + echo "❌ Container 'app1' is not connected to 'app-network'" + echo "Current networks: $network" + exit 1 + fi +else + echo "❌ Container 'app1' does not exist" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q7_s3_validate_ping.sh b/facilitator/assets/exams/other/001/scripts/validation/q7_s3_validate_ping.sh new file mode 100644 index 0000000..2e29da4 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q7_s3_validate_ping.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# Validate script for Question 7, Step 3: Check if app2 successfully pinged app1 + +# Check if app2 container was created +docker inspect app2 &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'app2' does not exist" + exit 1 +fi + +# Check if app2 container has completed +status=$(docker inspect --format='{{.State.Status}}' app2) + +if [[ "$status" != "exited" ]]; then + echo "❌ Container 'app2' has not completed its task (status: $status)" + exit 1 +fi + +# Check exit code (0 means success) +exit_code=$(docker inspect --format='{{.State.ExitCode}}' app2) + +if [[ "$exit_code" == "0" ]]; then + # Get logs to confirm ping was successful + logs=$(docker logs app2 2>&1) + + if [[ $logs == *"bytes from"* && $logs == *"app1"* ]]; then + echo "✅ Container 'app2' successfully pinged 'app1'" + exit 0 + else + echo "❌ Container 'app2' completed but logs don't show successful ping to 'app1'" + echo "Logs: $logs" + exit 1 + fi +else + echo "❌ Container 'app2' exited with non-zero code: $exit_code" + echo "Logs: $(docker logs app2 2>&1)" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q8_s1_validate_dockerfile.sh b/facilitator/assets/exams/other/001/scripts/validation/q8_s1_validate_dockerfile.sh new file mode 100644 index 0000000..5793b22 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q8_s1_validate_dockerfile.sh @@ -0,0 +1,33 @@ +#!/bin/bash +# Validate script for Question 8, Step 1: Check if Dockerfile contains HEALTHCHECK instruction + +# Check if the Dockerfile exists +if [ ! -f /tmp/exam/q8/Dockerfile ]; then + echo "❌ Dockerfile does not exist at /tmp/exam/q8/Dockerfile" + exit 1 +fi + +# Check if the Dockerfile has HEALTHCHECK +grep -q "HEALTHCHECK" /tmp/exam/q8/Dockerfile + +if [ $? -eq 0 ]; then + echo "✅ Dockerfile contains HEALTHCHECK instruction" + + # Check that it has appropriate parameters + if grep -q "HEALTHCHECK.*--interval=30s" /tmp/exam/q8/Dockerfile && \ + grep -q "HEALTHCHECK.*--timeout=10s" /tmp/exam/q8/Dockerfile && \ + grep -q "HEALTHCHECK.*--start-period=5s" /tmp/exam/q8/Dockerfile && \ + grep -q "HEALTHCHECK.*--retries=3" /tmp/exam/q8/Dockerfile; then + echo "✅ HEALTHCHECK includes all required parameters" + exit 0 + else + echo "❌ HEALTHCHECK is missing some required parameters" + echo "Expected: --interval=30s --timeout=10s --start-period=5s --retries=3" + echo "Found:" + grep "HEALTHCHECK" /tmp/exam/q8/Dockerfile + exit 1 + fi +else + echo "❌ Dockerfile does not contain HEALTHCHECK instruction" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q8_s2_validate_container.sh b/facilitator/assets/exams/other/001/scripts/validation/q8_s2_validate_container.sh new file mode 100644 index 0000000..064d7fa --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q8_s2_validate_container.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Validate script for Question 8, Step 2: Check if container is running with health check + +# Check if the container exists and is running +docker inspect healthy-app &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'healthy-app' does not exist" + exit 1 +fi + +# Check if it's running +running=$(docker inspect --format='{{.State.Running}}' healthy-app) + +if [ "$running" != "true" ]; then + echo "❌ Container 'healthy-app' exists but is not running" + exit 1 +fi + +# Check if health check is configured +health_check=$(docker inspect --format='{{.Config.Healthcheck}}' healthy-app) + +if [ -z "$health_check" ]; then + echo "❌ Container 'healthy-app' is running but has no health check configured" + exit 1 +else + echo "✅ Container 'healthy-app' is running with health check: $health_check" + exit 0 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q8_s3_validate_health_params.sh b/facilitator/assets/exams/other/001/scripts/validation/q8_s3_validate_health_params.sh new file mode 100644 index 0000000..95abf66 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q8_s3_validate_health_params.sh @@ -0,0 +1,46 @@ +#!/bin/bash +# Validate script for Question 8, Step 3: Check if health check parameters are correct + +# Check if the container exists +docker inspect healthy-app &> /dev/null + +if [ $? -ne 0 ]; then + echo "❌ Container 'healthy-app' does not exist" + exit 1 +fi + +# Get health check parameters +health_check=$(docker inspect --format='{{json .Config.Healthcheck}}' healthy-app) + +# Check for required parameters +if [[ $health_check == *"30000000000"* ]]; then # 30s in nanoseconds + echo "✅ Health check interval is set to 30s" +else + echo "❌ Health check interval is not set to 30s" + exit 1 +fi + +if [[ $health_check == *"10000000000"* ]]; then # 10s in nanoseconds + echo "✅ Health check timeout is set to 10s" +else + echo "❌ Health check timeout is not set to 10s" + exit 1 +fi + +if [[ $health_check == *"5000000000"* ]]; then # 5s in nanoseconds + echo "✅ Health check start period is set to 5s" +else + echo "❌ Health check start period is not set to 5s" + exit 1 +fi + +if [[ $health_check == *"\"Retries\":3"* ]]; then + echo "✅ Health check retries is set to 3" +else + echo "❌ Health check retries is not set to 3" + exit 1 +fi + +# If we got here, all checks passed +echo "✅ All health check parameters are set correctly" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q9_s1_validate_manifest.sh b/facilitator/assets/exams/other/001/scripts/validation/q9_s1_validate_manifest.sh new file mode 100644 index 0000000..ec75572 --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q9_s1_validate_manifest.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# Validate script for Question 9, Step 1: Check if manifest file exists + +# Check if the manifest file exists +if [ ! -f /tmp/exam/q9/manifest.json ]; then + echo "❌ Manifest file does not exist at /tmp/exam/q9/manifest.json" + exit 1 +fi + +# Check if the manifest file has valid content +grep -q "\"mediaType\"" /tmp/exam/q9/manifest.json + +if [ $? -eq 0 ]; then + # Verify it's for nginx:1.21.0 + if grep -q "nginx:1.21.0" /tmp/exam/q9/manifest.json || grep -q "\"name\":\"nginx\"" /tmp/exam/q9/manifest.json; then + echo "✅ Manifest file exists with valid content for nginx:1.21.0" + exit 0 + else + echo "❌ Manifest file exists but does not appear to be for nginx:1.21.0" + exit 1 + fi +else + echo "❌ Manifest file exists but does not have valid manifest content" + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/001/scripts/validation/q9_s2_validate_platforms.sh b/facilitator/assets/exams/other/001/scripts/validation/q9_s2_validate_platforms.sh new file mode 100644 index 0000000..0b9be0f --- /dev/null +++ b/facilitator/assets/exams/other/001/scripts/validation/q9_s2_validate_platforms.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# Validate script for Question 9, Step 2: Check if platforms file exists with correct data + +# Check if the platforms file exists +if [ ! -f /tmp/exam/q9/platforms.txt ]; then + echo "❌ Platforms file does not exist at /tmp/exam/q9/platforms.txt" + exit 1 +fi + +# Check if the platforms file has valid content +grep -q "architecture\|os" /tmp/exam/q9/platforms.txt + +if [ $? -eq 0 ]; then + # Check that it has at least basic platform info + if grep -q "amd64\|arm64\|linux" /tmp/exam/q9/platforms.txt; then + echo "✅ Platforms file exists with valid content" + exit 0 + else + echo "❌ Platforms file exists but does not have expected platform information" + echo "Expected to see architecture and OS information like 'amd64', 'arm64', or 'linux'" + echo "Content:" + cat /tmp/exam/q9/platforms.txt + exit 1 + fi +else + echo "❌ Platforms file exists but does not have valid platform content" + echo "Content:" + cat /tmp/exam/q9/platforms.txt + exit 1 +fi \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/answers.md b/facilitator/assets/exams/other/002/answers.md new file mode 100644 index 0000000..55d4b01 --- /dev/null +++ b/facilitator/assets/exams/other/002/answers.md @@ -0,0 +1,195 @@ +# Helm Basics Lab - Solutions + +## Question 1: Verify Helm Installation + +Verify the Helm installation by running the version command and saving the output to a file: + +```bash +# Check Helm version and save to file +helm version > /tmp/exam/q1/helm-version.txt + +# Verify the file content +cat /tmp/exam/q1/helm-version.txt +``` + +This command displays both the client and server version information, confirming that Helm is correctly installed and connected to the Kubernetes cluster. + +## Question 2: Add Bitnami Chart Repository + +```bash +# Add Bitnami repo +helm repo add bitnami https://charts.bitnami.com/bitnami + +# Update repo to fetch the latest chart information +helm repo update + +# Verify by listing repositories +helm repo list +``` + +## Question 3: Search for Nginx Chart + +```bash +# Search for nginx in the Bitnami repo +helm search repo bitnami/nginx + +# Save the results to a file +helm search repo bitnami/nginx > /tmp/exam/q3/nginx-charts.txt +``` + +## Question 4: Install Nginx Chart with Custom Configuration + +```bash +# Install nginx chart with custom service configuration +helm install web-server bitnami/nginx \ + --set service.type=NodePort \ + --set service.nodePorts.http=30080 +``` + +## Question 5: List All Helm Releases + +```bash +# List all releases across all namespaces +helm list -A > /tmp/exam/q5/releases.txt +``` + +## Question 6: Get Release Status and Manifests + +```bash +# Get status of the web-server release +helm status web-server > /tmp/exam/q6/web-server-status.txt + +# Get the manifests rendered by the chart +helm get manifest web-server > /tmp/exam/q6/web-server-manifests.txt +``` + +## Question 7: Upgrade Release with New Replica Count + +```bash +# Upgrade the release to set 3 replicas +helm upgrade web-server bitnami/nginx --set replicaCount=3 + +# Verify the update +kubectl get pods -l app.kubernetes.io/instance=web-server +``` + +## Question 8: Create Custom Values File and Install Redis + +First, create the values file for Redis: + +```bash +cat > /tmp/exam/q8/redis-values.yaml << EOF +password: "password123" +persistence: + enabled: true +resources: + limits: + memory: 256Mi + cpu: 100m +EOF +``` + +Then install Redis using the values file: + +```bash +helm install cache-db bitnami/redis -f /tmp/exam/q8/redis-values.yaml +``` + +## Question 9: Create a New Helm Chart + +```bash +# Create a new chart +helm create webapp + +# Modify the Chart.yaml file +cat > webapp/Chart.yaml << EOF +apiVersion: v2 +name: webapp +description: A simple web application +type: application +version: 0.1.0 +appVersion: "1.2.3" +EOF +``` + +## Question 10: Package Chart and Create Local Repository + +```bash +# Package the chart +helm package webapp + +# Create a charts directory +mkdir -p /tmp/exam/q10/charts + +# Move the packaged chart +mv webapp-*.tgz /tmp/exam/q10/charts/ + +# Create an index file +helm repo index /tmp/exam/q10/charts/ + +# Add the local repo +helm repo add localrepo /tmp/exam/q10/charts +``` + +## Question 11: Roll Back a Release + +```bash +# Check the history +helm history web-server + +# Roll back to revision 1 +helm rollback web-server 1 + +# Verify the rollback +helm status web-server +kubectl get deployment -l app.kubernetes.io/instance=web-server +``` + +## Question 12: Debug a Problematic Release + +First, diagnose the issue: + +```bash +# Check the release status +helm status buggy-app + +# Look at the pods +kubectl get pods -l app.kubernetes.io/instance=buggy-app + +# Check why pods are failing +kubectl describe pod -l app.kubernetes.io/instance=buggy-app +``` + +Create a diagnosis file: + +```bash +cat > /tmp/exam/q12/diagnosis.txt << EOF +The buggy-app release is failing because it's using a non-existent image tag "nonexistenttag". +The pods can't start because the container image "nginx:nonexistenttag" cannot be pulled. + +Steps taken to diagnose: +1. Used "helm status buggy-app" to check the release status +2. Used "kubectl get pods" to see pod status (ImagePullBackOff or ErrImagePull) +3. Used "kubectl describe pod" to see detailed error messages +EOF +``` + +Fix the issue: + +```bash +# Upgrade the release with a valid image tag +helm upgrade buggy-app buggy-app --set image.tag=latest +``` + +Alternatively, if you don't have access to the original chart: + +```bash +# Create a new values file to override the problematic values +cat > /tmp/fixed-values.yaml << EOF +image: + tag: latest +EOF + +# Upgrade using the new values file +helm upgrade buggy-app buggy-app -f /tmp/fixed-values.yaml +``` \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/assessment.json b/facilitator/assets/exams/other/002/assessment.json new file mode 100644 index 0000000..3e1f689 --- /dev/null +++ b/facilitator/assets/exams/other/002/assessment.json @@ -0,0 +1,252 @@ +{ + "questions": [ + { + "id": "1", + "namespace": "default", + "machineHostname": "node01", + "question": "Verify the existing Helm installation in the cluster by checking the Helm version.\n\nRun the version command and save the output to a file at `/tmp/exam/q1/helm-version.txt`.\n\nThe output should show both client and server version information.", + "concepts": ["helm", "verification"], + "verification": [ + { + "id": "1", + "description": "Helm version saved correctly", + "verificationScriptFile": "q1_s1_validate_helm_installed.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "2", + "namespace": "default", + "machineHostname": "node01", + "question": "Add the Bitnami chart repository to your Helm configuration with the name `bitnami` and URL `https://charts.bitnami.com/bitnami`.\n\nUpdate the repository to fetch the latest chart information. Verify success by listing all repositories.", + "concepts": ["helm", "repositories"], + "verification": [ + { + "id": "1", + "description": "Bitnami repo is added", + "verificationScriptFile": "q2_s1_validate_repo_added.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "3", + "namespace": "default", + "machineHostname": "node01", + "question": "Search for the nginx chart in the Bitnami repository.\n\nStore the search results in a file at `/tmp/exam/q3/nginx-charts.txt`.", + "concepts": ["helm", "chart search"], + "verification": [ + { + "id": "1", + "description": "Search results are saved correctly", + "verificationScriptFile": "q3_s1_validate_search_results.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "4", + "namespace": "default", + "machineHostname": "node01", + "question": "Install the Bitnami nginx chart with the release name `web-server` in the `default` namespace.\n\nEnsure the service type is set to `NodePort` and the port is set to `30080`. Only modify the necessary values without changing other default settings.", + "concepts": ["helm", "chart installation", "value overrides"], + "verification": [ + { + "id": "1", + "description": "Nginx chart is installed as web-server", + "verificationScriptFile": "q4_s1_validate_nginx_installed.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Service type is NodePort with port 30080", + "verificationScriptFile": "q4_s2_validate_service_config.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "5", + "namespace": "default", + "machineHostname": "node01", + "question": "List all Helm releases across all namespaces.\n\nSave the output to a file at `/tmp/exam/q5/releases.txt`.", + "concepts": ["helm", "release management"], + "verification": [ + { + "id": "1", + "description": "Releases list is saved correctly", + "verificationScriptFile": "q5_s1_validate_releases_list.sh", + "expectedOutput": "0", + "weightage": 4 + } + ] + }, + { + "id": "6", + "namespace": "default", + "machineHostname": "node01", + "question": "Get the status of the `web-server` release and save the output to a file at `/tmp/exam/q6/web-server-status.txt`.\n\nAlso, get a summary of the manifests rendered by the chart and save them to `/tmp/exam/q6/web-server-manifests.txt`.", + "concepts": ["helm", "release inspection"], + "verification": [ + { + "id": "1", + "description": "Release status is saved correctly", + "verificationScriptFile": "q6_s1_validate_status.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Manifest summary is saved correctly", + "verificationScriptFile": "q6_s2_validate_manifests.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "7", + "namespace": "default", + "machineHostname": "node01", + "question": "Upgrade the `web-server` release to set replica count to 3.\n\nVerify the update was successful by checking the number of pods.", + "concepts": ["helm", "release upgrade"], + "verification": [ + { + "id": "1", + "description": "Release was upgraded", + "verificationScriptFile": "q7_s1_validate_upgrade.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Replica count is 3", + "verificationScriptFile": "q7_s2_validate_replicas.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "8", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a new values file at `/tmp/exam/q8/redis-values.yaml` for a Redis installation with the following configurations:\n\n- Password: \"password123\"\n- Persistence enabled\n- Resource limits: 256Mi memory and 100m CPU\n\nThen install the Bitnami Redis chart using this values file, with the release name `cache-db` in the `default` namespace.", + "concepts": ["helm", "values files", "advanced installation"], + "verification": [ + { + "id": "1", + "description": "Values file created correctly", + "verificationScriptFile": "q8_s1_validate_values_file.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Redis chart installed with correct values", + "verificationScriptFile": "q8_s2_validate_redis_install.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "9", + "namespace": "default", + "machineHostname": "node01", + "question": "Create a new Helm chart named `webapp` using the Helm create command.\n\nModify the Chart.yaml to include a description: \"A simple web application\" and set the appVersion to \"1.2.3\".", + "concepts": ["helm", "chart creation"], + "verification": [ + { + "id": "1", + "description": "Chart structure created", + "verificationScriptFile": "q9_s1_validate_chart_created.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Chart.yaml modified correctly", + "verificationScriptFile": "q9_s2_validate_chart_metadata.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "10", + "namespace": "default", + "machineHostname": "node01", + "question": "Package the `webapp` chart you created into a `.tgz` file.\n\nThen create a local chart repository by:\n1. Creating a directory at `/tmp/exam/q10/charts`\n2. Moving the packaged chart to this directory\n3. Creating an index file for this repository\n4. Adding this local repository to Helm with the name `localrepo`", + "concepts": ["helm", "chart packaging", "repository management"], + "verification": [ + { + "id": "1", + "description": "Chart is packaged", + "verificationScriptFile": "q10_s1_validate_chart_packaged.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Local repo is created and configured", + "verificationScriptFile": "q10_s2_validate_local_repo.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "11", + "namespace": "default", + "machineHostname": "node01", + "question": "Roll back the `web-server` release to its first revision (the original installation).\n\nVerify the rollback was successful by checking the revision number and that the replica count is back to the original value.", + "concepts": ["helm", "rollback"], + "verification": [ + { + "id": "1", + "description": "Release was rolled back", + "verificationScriptFile": "q11_s1_validate_rollback.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Revision and configuration are correct", + "verificationScriptFile": "q11_s2_validate_revision.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + }, + { + "id": "12", + "namespace": "default", + "machineHostname": "node01", + "question": "Debug an existing problematic release named `buggy-app` in the `default` namespace.\n\n1. Use Helm's debug capabilities to identify the issue\n2. Create a file at `/tmp/exam/q12/diagnosis.txt` explaining the problem\n3. Fix the release by performing the necessary upgrade or reinstallation", + "concepts": ["helm", "debugging", "troubleshooting"], + "verification": [ + { + "id": "1", + "description": "Diagnosis file created with analysis", + "verificationScriptFile": "q12_s1_validate_diagnosis.sh", + "expectedOutput": "0", + "weightage": 2 + }, + { + "id": "2", + "description": "Release issue fixed", + "verificationScriptFile": "q12_s2_validate_fixed.sh", + "expectedOutput": "0", + "weightage": 2 + } + ] + } + ] +} \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/config.json b/facilitator/assets/exams/other/002/config.json new file mode 100644 index 0000000..9716654 --- /dev/null +++ b/facilitator/assets/exams/other/002/config.json @@ -0,0 +1,10 @@ +{ + "lab": "helm-001", + "workerNodes": 1, + "answers": "assets/exams/other/002/answers.md", + "questions": "assessment.json", + "totalMarks": 100, + "lowScore": 40, + "mediumScore": 60, + "highScore": 90 +} \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/setup/create_directories.sh b/facilitator/assets/exams/other/002/scripts/setup/create_directories.sh new file mode 100644 index 0000000..a6e31e9 --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/setup/create_directories.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Setup script to create directories for all questions + +# Create main exam directory +mkdir -p /tmp/exam + +# Create directories for each question +for i in {1..12}; do + mkdir -p /tmp/exam/q$i + echo "Created directory for Question $i" +done + +echo "All exam directories have been created successfully" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/setup/q12_setup_buggy_release.sh b/facilitator/assets/exams/other/002/scripts/setup/q12_setup_buggy_release.sh new file mode 100644 index 0000000..d9cce5d --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/setup/q12_setup_buggy_release.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# Setup script for Question 12: Create a buggy Helm release + +# Create exam directory +mkdir -p /tmp/exam/q12 + +# Create a simple chart with an intentional issue +mkdir -p /tmp/buggy-chart/templates + +# Create Chart.yaml +cat < /tmp/buggy-chart/Chart.yaml +apiVersion: v2 +name: buggy-app +description: A buggy Helm chart for demonstration +version: 0.1.0 +appVersion: 1.0.0 +EOF + +# Create values.yaml with an incorrect image reference +cat < /tmp/buggy-chart/values.yaml +replicaCount: 1 + +image: + repository: nginx + # Intentionally using a non-existent tag + tag: nonexistenttag + pullPolicy: IfNotPresent + +service: + type: ClusterIP + port: 80 +EOF + +# Create a deployment template with an issue +cat < /tmp/buggy-chart/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }} + labels: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} + spec: + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP +EOF + +# Create a service template +cat < /tmp/buggy-chart/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }} + labels: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} +EOF + +# Install the buggy chart +helm install buggy-app /tmp/buggy-chart + +# Clean up the temporary chart directory +rm -rf /tmp/buggy-chart + +echo "Buggy Helm release 'buggy-app' has been created" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q10_s1_validate_chart_packaged.sh b/facilitator/assets/exams/other/002/scripts/validation/q10_s1_validate_chart_packaged.sh new file mode 100644 index 0000000..8c1eb8e --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q10_s1_validate_chart_packaged.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# Validate script for Question 10, Step 1: Check if chart is packaged + +# Check if the packaged chart is in the current directory +if ! ls webapp-*.tgz &>/dev/null; then + # Check if it was moved to the repository directory already + if ! ls /tmp/exam/q10/charts/webapp-*.tgz &>/dev/null; then + echo "❌ Packaged chart (webapp-*.tgz) not found in current directory or repository directory" + echo "Current directory contents:" + ls -la + echo "Repository directory contents (if exists):" + ls -la /tmp/exam/q10/charts 2>/dev/null || echo "Repository directory does not exist yet" + exit 1 + else + echo "✅ Chart is packaged and moved to the repository directory" + echo "Repository directory contents:" + ls -la /tmp/exam/q10/charts + exit 0 + fi +fi + +echo "✅ Chart is packaged (but not yet moved to repository directory)" +echo "Current directory contents:" +ls -la webapp-*.tgz +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q10_s2_validate_local_repo.sh b/facilitator/assets/exams/other/002/scripts/validation/q10_s2_validate_local_repo.sh new file mode 100644 index 0000000..d43d0fd --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q10_s2_validate_local_repo.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# Validate script for Question 10, Step 2: Check if local repo is created and configured + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check if the charts directory exists +if [ ! -d /tmp/exam/q10/charts ]; then + echo "❌ Charts directory does not exist at /tmp/exam/q10/charts" + exit 1 +fi + +# Check if the packaged chart exists in the directory +if ! ls /tmp/exam/q10/charts/webapp-*.tgz &>/dev/null; then + echo "❌ Packaged chart not found in the charts directory" + echo "Directory contents:" + ls -la /tmp/exam/q10/charts + exit 1 +fi + +# Check if the index.yaml file was created +if [ ! -f /tmp/exam/q10/charts/index.yaml ]; then + echo "❌ Index file does not exist at /tmp/exam/q10/charts/index.yaml" + exit 1 +fi + +# Check if the index file contains the webapp chart +if ! grep -q "webapp" /tmp/exam/q10/charts/index.yaml; then + echo "❌ Index file does not contain the webapp chart" + echo "Index file content:" + cat /tmp/exam/q10/charts/index.yaml + exit 1 +fi + +# Check if the local repository is added to Helm +repo_list=$(helm repo list 2>&1) +if ! echo "$repo_list" | grep -q "localrepo"; then + echo "❌ Local repository 'localrepo' not found in Helm repositories" + echo "Current repositories:" + echo "$repo_list" + exit 1 +fi + +# Check if the URL is set to the correct path +local_path="/tmp/exam/q10/charts" +if ! echo "$repo_list" | grep -q "localrepo.*$local_path"; then + echo "❌ Local repository URL is not set to $local_path" + echo "Current repositories:" + echo "$repo_list" + exit 1 +fi + +echo "✅ Local chart repository is created and configured correctly" +echo "Repository content:" +ls -la /tmp/exam/q10/charts +echo "Repository list:" +echo "$repo_list" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q11_s1_validate_rollback.sh b/facilitator/assets/exams/other/002/scripts/validation/q11_s1_validate_rollback.sh new file mode 100644 index 0000000..5b67a12 --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q11_s1_validate_rollback.sh @@ -0,0 +1,40 @@ +#!/bin/bash +# Validate script for Question 11, Step 1: Check if release was rolled back + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check if the release exists +release_info=$(helm list -n default -f "web-server" 2>&1) + +if [ $? -ne 0 ] || ! echo "$release_info" | grep -q "web-server"; then + echo "❌ Release 'web-server' not found in namespace 'default'" + echo "Current releases:" + helm list -n default + exit 1 +fi + +# Check the history to see if a rollback occurred +history=$(helm history web-server -n default 2>&1) + +if [ $? -ne 0 ]; then + echo "❌ Failed to get history for release 'web-server'" + echo "Error: $history" + exit 1 +fi + +# Check if there was a rollback operation in the history +if ! echo "$history" | grep -q "rollback"; then + echo "❌ No rollback operation found in the release history" + echo "Release history:" + echo "$history" + exit 1 +fi + +echo "✅ Release 'web-server' has been rolled back" +echo "Release history:" +echo "$history" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q11_s2_validate_revision.sh b/facilitator/assets/exams/other/002/scripts/validation/q11_s2_validate_revision.sh new file mode 100644 index 0000000..885dcad --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q11_s2_validate_revision.sh @@ -0,0 +1,53 @@ +#!/bin/bash +# Validate script for Question 11, Step 2: Check if revision and configuration are correct + +# Check if kubectl command is available +if ! command -v kubectl &> /dev/null; then + echo "❌ kubectl command not found in PATH" + exit 1 +fi + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check the current revision number +revision=$(helm list -n default -f "web-server" -o json | jq -r '.[0].revision') + +if [ -z "$revision" ] || [ "$revision" = "null" ]; then + echo "❌ Could not determine revision for release 'web-server'" + exit 1 +fi + +# We need to check if the replica count is back to the original value (likely 1) +# Find the deployment name +deploy_name=$(kubectl get deployments -n default -o custom-columns=NAME:.metadata.name | grep "web-server.*nginx") + +if [ -z "$deploy_name" ]; then + echo "❌ Could not find the web-server nginx deployment" + echo "Available deployments:" + kubectl get deployments -n default + exit 1 +fi + +# Get the replica count +replicas=$(kubectl get deployment $deploy_name -n default -o jsonpath='{.spec.replicas}') + +if [ -z "$replicas" ]; then + echo "❌ Could not determine replica count for deployment '$deploy_name'" + exit 1 +fi + +# If we rolled back to revision 1, we expect the replicas to be 1 +# If not, we check that it's different from 3 (the value set in question 7) +if [ "$replicas" -eq 3 ]; then + echo "❌ Replica count is still 3, rollback did not reset the configuration" + exit 1 +fi + +echo "✅ Release 'web-server' is at revision $revision with replica count $replicas" +echo "Pods status:" +kubectl get pods -n default -l app=nginx,release=web-server +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q12_s1_validate_diagnosis.sh b/facilitator/assets/exams/other/002/scripts/validation/q12_s1_validate_diagnosis.sh new file mode 100644 index 0000000..f070c7b --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q12_s1_validate_diagnosis.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# Validate script for Question 12, Step 1: Check if diagnosis file is created with analysis + +# Check if the diagnosis file exists +if [ ! -f /tmp/exam/q12/diagnosis.txt ]; then + echo "❌ Diagnosis file does not exist at /tmp/exam/q12/diagnosis.txt" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q12/diagnosis.txt ]; then + echo "❌ Diagnosis file exists but is empty" + exit 1 +fi + +# Check if the file contains debugging information +# Look for common debugging terms and commands that would be used +if ! grep -E -i "(error|issue|problem|failed|debug|helm|not found|missing|incorrect)" /tmp/exam/q12/diagnosis.txt > /dev/null; then + echo "❌ Diagnosis file does not appear to contain debugging analysis" + echo "Expected to find error/issue descriptions" + echo "File content:" + cat /tmp/exam/q12/diagnosis.txt + exit 1 +fi + +# Check if the diagnosis contains helm debug commands or output +if ! grep -E -i "(helm get|helm status|helm debug|helm history|kubectl describe)" /tmp/exam/q12/diagnosis.txt > /dev/null; then + echo "❌ Diagnosis does not show evidence of using Helm debugging commands" + echo "Expected to find mentions of 'helm get', 'helm status', etc." + echo "File content:" + cat /tmp/exam/q12/diagnosis.txt + exit 1 +fi + +echo "✅ Diagnosis file has been created with debugging analysis" +echo "File content:" +cat /tmp/exam/q12/diagnosis.txt +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q12_s2_validate_fixed.sh b/facilitator/assets/exams/other/002/scripts/validation/q12_s2_validate_fixed.sh new file mode 100644 index 0000000..010b44d --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q12_s2_validate_fixed.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# Validate script for Question 12, Step 2: Check if release issue is fixed + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check if the release exists +release_info=$(helm list -n default -f "buggy-app" 2>&1) + +if [ $? -ne 0 ] || ! echo "$release_info" | grep -q "buggy-app"; then + echo "❌ Release 'buggy-app' not found in namespace 'default'" + echo "Current releases:" + helm list -n default + exit 1 +fi + +# Check if the release status is deployed/succeeded +status=$(helm list -n default -f "buggy-app" -o json | jq -r '.[0].status') +if [ "$status" != "deployed" ]; then + echo "❌ Release 'buggy-app' is not in 'deployed' status (current: $status)" + exit 1 +fi + +# Check if the pods are running +deploy_name=$(kubectl get deployments -n default -o custom-columns=NAME:.metadata.name | grep "buggy-app" | head -1) +if [ -z "$deploy_name" ]; then + echo "❌ Could not find any deployment for 'buggy-app'" + echo "Available deployments:" + kubectl get deployments -n default + exit 1 +fi + +# Check pod status +pod_status=$(kubectl get pods -n default -l app.kubernetes.io/instance=buggy-app -o jsonpath='{.items[0].status.phase}' 2>/dev/null) + +if [ -z "$pod_status" ]; then + echo "❌ No pods found for 'buggy-app'" + echo "Available pods:" + kubectl get pods -n default + exit 1 +fi + +if [ "$pod_status" != "Running" ]; then + echo "❌ Pod for 'buggy-app' is not running (status: $pod_status)" + echo "Pod details:" + kubectl get pods -n default -l app.kubernetes.io/instance=buggy-app -o wide + exit 1 +fi + +echo "✅ 'buggy-app' release has been fixed and is running correctly" +echo "Release status: $status" +echo "Pod status: $pod_status" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q1_s1_validate_helm_installed.sh b/facilitator/assets/exams/other/002/scripts/validation/q1_s1_validate_helm_installed.sh new file mode 100644 index 0000000..bdce02b --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q1_s1_validate_helm_installed.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Validate script for Question 1, Step 1: Check if Helm version is saved correctly + +# Check if the version file exists +if [ ! -f /tmp/exam/q1/helm-version.txt ]; then + echo "❌ Helm version file does not exist at /tmp/exam/q1/helm-version.txt" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q1/helm-version.txt ]; then + echo "❌ Helm version file exists but is empty" + exit 1 +fi + +# Check if the file contains Helm version information +if ! grep -q "version.BuildInfo" /tmp/exam/q1/helm-version.txt; then + echo "❌ Helm version file does not contain client version information" + echo "File content:" + cat /tmp/exam/q1/helm-version.txt + exit 1 +fi + +# Check for server connection (Tiller in v2 or Kubernetes API in v3) +if grep -q "Error" /tmp/exam/q1/helm-version.txt; then + echo "❌ Helm version file shows connection errors" + echo "File content:" + cat /tmp/exam/q1/helm-version.txt + exit 1 +fi + +echo "✅ Helm version saved correctly showing proper client and server information" +echo "File content:" +cat /tmp/exam/q1/helm-version.txt +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q2_s1_validate_repo_added.sh b/facilitator/assets/exams/other/002/scripts/validation/q2_s1_validate_repo_added.sh new file mode 100644 index 0000000..bf59b29 --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q2_s1_validate_repo_added.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# Validate script for Question 2, Step 1: Check if Bitnami repo is added + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Get the list of repositories +repo_list=$(helm repo list 2>&1) + +# Check if the command was successful +if [ $? -ne 0 ]; then + echo "❌ Failed to list Helm repositories" + echo "Error: $repo_list" + exit 1 +fi + +# Check if Bitnami repo is in the list +if ! echo "$repo_list" | grep -q "bitnami"; then + echo "❌ Bitnami repository not found in Helm repositories" + echo "Current repositories:" + echo "$repo_list" + exit 1 +fi + +# Check if the URL is correct +if ! echo "$repo_list" | grep -q "bitnami.*https://charts.bitnami.com/bitnami"; then + echo "❌ Bitnami repository found but URL is incorrect" + echo "Current repositories:" + echo "$repo_list" + exit 1 +fi + +echo "✅ Bitnami repository is properly added to Helm" +echo "Repository list:" +echo "$repo_list" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q3_s1_validate_search_results.sh b/facilitator/assets/exams/other/002/scripts/validation/q3_s1_validate_search_results.sh new file mode 100644 index 0000000..039619b --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q3_s1_validate_search_results.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# Validate script for Question 3, Step 1: Check if nginx chart search results are saved + +# Check if the results file exists +if [ ! -f /tmp/exam/q3/nginx-charts.txt ]; then + echo "❌ Search results file does not exist at /tmp/exam/q3/nginx-charts.txt" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q3/nginx-charts.txt ]; then + echo "❌ Search results file exists but is empty" + exit 1 +fi + +# Check if the file contains nginx chart information from Bitnami +if ! grep -q "bitnami/nginx" /tmp/exam/q3/nginx-charts.txt; then + echo "❌ Search results file does not contain Bitnami nginx chart information" + echo "File content:" + cat /tmp/exam/q3/nginx-charts.txt + exit 1 +fi + +# Check if the file appears to be the output of a helm search command +if ! grep -q "NAME\|VERSION\|DESCRIPTION" /tmp/exam/q3/nginx-charts.txt; then + echo "❌ Search results file does not appear to be from helm search command" + echo "Expected headers like 'NAME', 'VERSION', 'DESCRIPTION'" + echo "File content:" + cat /tmp/exam/q3/nginx-charts.txt + exit 1 +fi + +echo "✅ Nginx chart search results are correctly saved" +echo "Sample content:" +head -5 /tmp/exam/q3/nginx-charts.txt +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q4_s1_validate_nginx_installed.sh b/facilitator/assets/exams/other/002/scripts/validation/q4_s1_validate_nginx_installed.sh new file mode 100644 index 0000000..fbea1bb --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q4_s1_validate_nginx_installed.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# Validate script for Question 4, Step 1: Check if nginx chart is installed + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check if the release exists +release_info=$(helm list -n default -f "web-server" 2>&1) + +if [ $? -ne 0 ] || ! echo "$release_info" | grep -q "web-server"; then + echo "❌ Release 'web-server' not found in namespace 'default'" + echo "Current releases:" + helm list -n default + exit 1 +fi + +# Check if it's using the Bitnami nginx chart +if ! helm get values web-server -n default | grep -q "nginx"; then + echo "❌ Release 'web-server' does not appear to be using the nginx chart" + echo "Release information:" + echo "$release_info" + exit 1 +fi + +echo "✅ Nginx chart is installed with release name 'web-server'" +echo "Release information:" +echo "$release_info" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q4_s2_validate_service_config.sh b/facilitator/assets/exams/other/002/scripts/validation/q4_s2_validate_service_config.sh new file mode 100644 index 0000000..b14abea --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q4_s2_validate_service_config.sh @@ -0,0 +1,40 @@ +#!/bin/bash +# Validate script for Question 4, Step 2: Check if service is configured correctly + +# Check if kubernetes command is available +if ! command -v kubectl &> /dev/null; then + echo "❌ kubectl command not found in PATH" + exit 1 +fi + +# Get the service information +service_name="web-server-nginx" +service_info=$(kubectl get service $service_name -n default -o json 2>&1) + +if [ $? -ne 0 ]; then + echo "❌ Service '$service_name' not found in namespace 'default'" + echo "Available services:" + kubectl get services -n default + exit 1 +fi + +# Check if the service type is NodePort +service_type=$(echo "$service_info" | jq -r '.spec.type') +if [ "$service_type" != "NodePort" ]; then + echo "❌ Service type is '$service_type', expected 'NodePort'" + exit 1 +fi + +# Check if the port is configured correctly +nodeport=$(echo "$service_info" | jq -r '.spec.ports[] | select(.nodePort) | .nodePort') +if [ "$nodeport" != "30080" ]; then + echo "❌ NodePort is '$nodeport', expected '30080'" + echo "Service ports configuration:" + echo "$service_info" | jq '.spec.ports' + exit 1 +fi + +echo "✅ Service is correctly configured with type NodePort and port 30080" +echo "Service information:" +kubectl get service $service_name -n default -o wide +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q5_s1_validate_releases_list.sh b/facilitator/assets/exams/other/002/scripts/validation/q5_s1_validate_releases_list.sh new file mode 100644 index 0000000..31570ad --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q5_s1_validate_releases_list.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# Validate script for Question 5, Step 1: Check if releases list is saved correctly + +# Check if the releases file exists +if [ ! -f /tmp/exam/q5/releases.txt ]; then + echo "❌ Releases list file does not exist at /tmp/exam/q5/releases.txt" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q5/releases.txt ]; then + echo "❌ Releases list file exists but is empty" + exit 1 +fi + +# Get current releases to compare +current_releases=$(helm list -A 2>/dev/null) + +# Check if the file contains Helm release information +if ! grep -q "NAME\|NAMESPACE\|REVISION\|STATUS" /tmp/exam/q5/releases.txt; then + echo "❌ Releases list file does not appear to be from helm list command" + echo "Expected headers like 'NAME', 'NAMESPACE', 'REVISION', 'STATUS'" + echo "File content:" + cat /tmp/exam/q5/releases.txt + exit 1 +fi + +# Check if the file contains the web-server release we created in Q4 +if ! grep -q "web-server" /tmp/exam/q5/releases.txt; then + echo "❌ Releases list file does not contain the 'web-server' release" + echo "File content:" + cat /tmp/exam/q5/releases.txt + exit 1 +fi + +# Check if the command was run with -A flag to show all namespaces +# This is a bit lenient as it just checks if there are entries from +# namespaces other than default, if they exist +if [ $(helm list -A | grep -v "default" | wc -l) -gt 0 ]; then + if ! grep -v "default" /tmp/exam/q5/releases.txt > /dev/null; then + echo "❌ Releases list does not include releases from all namespaces" + echo "File content might not have been generated with 'helm list -A'" + exit 1 + fi +fi + +echo "✅ Helm releases list is correctly saved" +echo "Sample content:" +head -5 /tmp/exam/q5/releases.txt +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q6_s1_validate_status.sh b/facilitator/assets/exams/other/002/scripts/validation/q6_s1_validate_status.sh new file mode 100644 index 0000000..1de16ce --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q6_s1_validate_status.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# Validate script for Question 6, Step 1: Check if release status is saved correctly + +# Check if the status file exists +if [ ! -f /tmp/exam/q6/web-server-status.txt ]; then + echo "❌ Release status file does not exist at /tmp/exam/q6/web-server-status.txt" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q6/web-server-status.txt ]; then + echo "❌ Release status file exists but is empty" + exit 1 +fi + +# Check if the file contains Helm status information +if ! grep -q "NAME: web-server" /tmp/exam/q6/web-server-status.txt; then + echo "❌ Status file does not contain information for release 'web-server'" + echo "File content:" + cat /tmp/exam/q6/web-server-status.txt + exit 1 +fi + +# Check for key status sections +if ! grep -q "LAST DEPLOYED:" /tmp/exam/q6/web-server-status.txt || \ + ! grep -q "NAMESPACE:" /tmp/exam/q6/web-server-status.txt || \ + ! grep -q "STATUS:" /tmp/exam/q6/web-server-status.txt; then + echo "❌ Status file does not contain complete status information" + echo "Expected to find sections like 'LAST DEPLOYED', 'NAMESPACE', 'STATUS'" + echo "File content:" + cat /tmp/exam/q6/web-server-status.txt + exit 1 +fi + +echo "✅ Release status is correctly saved" +echo "Sample content:" +head -10 /tmp/exam/q6/web-server-status.txt +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q6_s2_validate_manifests.sh b/facilitator/assets/exams/other/002/scripts/validation/q6_s2_validate_manifests.sh new file mode 100644 index 0000000..3ee792b --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q6_s2_validate_manifests.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# Validate script for Question 6, Step 2: Check if manifests summary is saved correctly + +# Check if the manifests file exists +if [ ! -f /tmp/exam/q6/web-server-manifests.txt ]; then + echo "❌ Manifests file does not exist at /tmp/exam/q6/web-server-manifests.txt" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q6/web-server-manifests.txt ]; then + echo "❌ Manifests file exists but is empty" + exit 1 +fi + +# Check if the file contains Kubernetes manifest information +if ! grep -q "apiVersion\|kind\|metadata" /tmp/exam/q6/web-server-manifests.txt; then + echo "❌ Manifests file does not contain Kubernetes manifest information" + echo "Expected to find Kubernetes manifest contents with 'apiVersion', 'kind', 'metadata', etc." + echo "File content:" + cat /tmp/exam/q6/web-server-manifests.txt + exit 1 +fi + +# Check if it contains the expected resource types for an nginx deployment +if ! grep -q "Deployment" /tmp/exam/q6/web-server-manifests.txt || \ + ! grep -q "Service" /tmp/exam/q6/web-server-manifests.txt; then + echo "❌ Manifests file does not contain expected resource types" + echo "Expected to find at least Deployment and Service resources" + echo "File content snippet:" + head -20 /tmp/exam/q6/web-server-manifests.txt + exit 1 +fi + +echo "✅ Release manifests are correctly saved" +echo "Sample content:" +head -10 /tmp/exam/q6/web-server-manifests.txt +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q7_s1_validate_upgrade.sh b/facilitator/assets/exams/other/002/scripts/validation/q7_s1_validate_upgrade.sh new file mode 100644 index 0000000..aa0db6a --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q7_s1_validate_upgrade.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# Validate script for Question 7, Step 1: Check if release was upgraded + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check if the release exists +release_info=$(helm list -n default -f "web-server" 2>&1) + +if [ $? -ne 0 ] || ! echo "$release_info" | grep -q "web-server"; then + echo "❌ Release 'web-server' not found in namespace 'default'" + echo "Current releases:" + helm list -n default + exit 1 +fi + +# Check if it's been upgraded (revision > 1) +revision=$(helm list -n default -f "web-server" -o json | jq -r '.[0].revision') + +if [ -z "$revision" ] || [ "$revision" = "null" ]; then + echo "❌ Could not determine revision for release 'web-server'" + exit 1 +fi + +if [ "$revision" -le 1 ]; then + echo "❌ Release 'web-server' has not been upgraded (revision: $revision)" + exit 1 +fi + +echo "✅ Release 'web-server' has been upgraded to revision $revision" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q7_s2_validate_replicas.sh b/facilitator/assets/exams/other/002/scripts/validation/q7_s2_validate_replicas.sh new file mode 100644 index 0000000..dab2f69 --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q7_s2_validate_replicas.sh @@ -0,0 +1,45 @@ +#!/bin/bash +# Validate script for Question 7, Step 2: Check if replica count is 3 + +# Check if kubectl command is available +if ! command -v kubectl &> /dev/null; then + echo "❌ kubectl command not found in PATH" + exit 1 +fi + +# Find the deployment name (assuming it has web-server and nginx in the name) +deploy_name=$(kubectl get deployments -n default -o custom-columns=NAME:.metadata.name | grep "web-server.*nginx") + +if [ -z "$deploy_name" ]; then + echo "❌ Could not find the web-server nginx deployment" + echo "Available deployments:" + kubectl get deployments -n default + exit 1 +fi + +# Get the replica count +replicas=$(kubectl get deployment $deploy_name -n default -o jsonpath='{.spec.replicas}') + +if [ -z "$replicas" ]; then + echo "❌ Could not determine replica count for deployment '$deploy_name'" + exit 1 +fi + +if [ "$replicas" -ne 3 ]; then + echo "❌ Deployment '$deploy_name' does not have 3 replicas (current: $replicas)" + exit 1 +fi + +# Also check if the pods are actually running +ready_pods=$(kubectl get deployment $deploy_name -n default -o jsonpath='{.status.readyReplicas}') +if [ -z "$ready_pods" ] || [ "$ready_pods" -ne 3 ]; then + echo "❌ Deployment has 3 replicas set but only $ready_pods pods are ready" + echo "Pods status:" + kubectl get pods -n default -l app=nginx,release=web-server + exit 1 +fi + +echo "✅ Deployment '$deploy_name' has 3 replicas and all pods are ready" +echo "Pods status:" +kubectl get pods -n default -l app=nginx,release=web-server +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q8_s1_validate_values_file.sh b/facilitator/assets/exams/other/002/scripts/validation/q8_s1_validate_values_file.sh new file mode 100644 index 0000000..b54432e --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q8_s1_validate_values_file.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# Validate script for Question 8, Step 1: Check if values file is created correctly + +# Check if the values file exists +if [ ! -f /tmp/exam/q8/redis-values.yaml ]; then + echo "❌ Values file does not exist at /tmp/exam/q8/redis-values.yaml" + exit 1 +fi + +# Check if the file has content +if [ ! -s /tmp/exam/q8/redis-values.yaml ]; then + echo "❌ Values file exists but is empty" + exit 1 +fi + +# Check for password configuration +if ! grep -q "password.*password123" /tmp/exam/q8/redis-values.yaml; then + echo "❌ Values file does not set the password to 'password123'" + echo "File content:" + cat /tmp/exam/q8/redis-values.yaml + exit 1 +fi + +# Check for persistence enabled +if ! grep -q "persistence.*enabled.*true" /tmp/exam/q8/redis-values.yaml; then + echo "❌ Values file does not enable persistence" + echo "File content:" + cat /tmp/exam/q8/redis-values.yaml + exit 1 +fi + +# Check for resource limits +if ! grep -q "memory.*256Mi" /tmp/exam/q8/redis-values.yaml || ! grep -q "cpu.*100m" /tmp/exam/q8/redis-values.yaml; then + echo "❌ Values file does not set correct resource limits" + echo "Expected memory: 256Mi and cpu: 100m" + echo "File content:" + cat /tmp/exam/q8/redis-values.yaml + exit 1 +fi + +echo "✅ Values file is created correctly with all required configurations" +echo "File content:" +cat /tmp/exam/q8/redis-values.yaml +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q8_s2_validate_redis_install.sh b/facilitator/assets/exams/other/002/scripts/validation/q8_s2_validate_redis_install.sh new file mode 100644 index 0000000..78bc64d --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q8_s2_validate_redis_install.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# Validate script for Question 8, Step 2: Check if Redis chart is installed with correct values + +# Check if helm command is available +if ! command -v helm &> /dev/null; then + echo "❌ Helm command not found in PATH" + exit 1 +fi + +# Check if the release exists +release_info=$(helm list -n default -f "cache-db" 2>&1) + +if [ $? -ne 0 ] || ! echo "$release_info" | grep -q "cache-db"; then + echo "❌ Release 'cache-db' not found in namespace 'default'" + echo "Current releases:" + helm list -n default + exit 1 +fi + +# Check if it's using the Redis chart +chart=$(helm list -n default -f "cache-db" -o json | jq -r '.[0].chart') +if [[ "$chart" != *"redis"* ]]; then + echo "❌ Release 'cache-db' is not using a Redis chart (chart: $chart)" + exit 1 +fi + +# Check if the values were applied correctly +# 1. Check password +password_set=$(helm get values cache-db -n default -o json | jq -r '.password // empty') +if [ -z "$password_set" ] || [ "$password_set" != "password123" ]; then + echo "❌ Redis password is not set to 'password123'" + exit 1 +fi + +# 2. Check persistence +persistence_enabled=$(helm get values cache-db -n default -o json | jq -r '.persistence.enabled // empty') +if [ "$persistence_enabled" != "true" ]; then + echo "❌ Redis persistence is not enabled" + exit 1 +fi + +# 3. Check resources +memory_limit=$(helm get values cache-db -n default -o json | jq -r '.resources.limits.memory // empty') +cpu_limit=$(helm get values cache-db -n default -o json | jq -r '.resources.limits.cpu // empty') + +if [ "$memory_limit" != "256Mi" ] || [ "$cpu_limit" != "100m" ]; then + echo "❌ Redis resource limits are not set correctly" + echo "Expected memory: 256Mi, found: $memory_limit" + echo "Expected cpu: 100m, found: $cpu_limit" + exit 1 +fi + +echo "✅ Redis chart is installed with correct values" +echo "Release information:" +echo "$release_info" +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q9_s1_validate_chart_created.sh b/facilitator/assets/exams/other/002/scripts/validation/q9_s1_validate_chart_created.sh new file mode 100644 index 0000000..35d053f --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q9_s1_validate_chart_created.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# Validate script for Question 9, Step 1: Check if chart structure is created + +# Check if the chart directory exists +if [ ! -d webapp ]; then + echo "❌ Chart directory 'webapp' not found in current directory" + echo "Current directory contents:" + ls -la + exit 1 +fi + +# Check for standard Helm chart files and directories +required_files=("Chart.yaml" "values.yaml" "templates/deployment.yaml" "templates/service.yaml") +for file in "${required_files[@]}"; do + if [ ! -f "webapp/$file" ]; then + echo "❌ Required chart file 'webapp/$file' not found" + echo "Chart structure is incomplete" + exit 1 + fi +fi + +# Check for Helm chart helper files +if [ ! -f "webapp/templates/_helpers.tpl" ] || [ ! -f "webapp/templates/NOTES.txt" ]; then + echo "❌ Chart helper files not found" + echo "Expected 'webapp/templates/_helpers.tpl' and 'webapp/templates/NOTES.txt'" + exit 1 +fi + +echo "✅ Helm chart 'webapp' created with the correct structure" +echo "Chart structure:" +find webapp -type f | sort +exit 0 \ No newline at end of file diff --git a/facilitator/assets/exams/other/002/scripts/validation/q9_s2_validate_chart_metadata.sh b/facilitator/assets/exams/other/002/scripts/validation/q9_s2_validate_chart_metadata.sh new file mode 100644 index 0000000..2593d4d --- /dev/null +++ b/facilitator/assets/exams/other/002/scripts/validation/q9_s2_validate_chart_metadata.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Validate script for Question 9, Step 2: Check if Chart.yaml is modified correctly + +# Check if the Chart.yaml file exists +if [ ! -f webapp/Chart.yaml ]; then + echo "❌ Chart.yaml not found in webapp directory" + exit 1 +fi + +# Check if the description is set correctly +description=$(grep "description:" webapp/Chart.yaml | sed 's/description: //g' | tr -d '"' | tr -d "'" | xargs) +if [ "$description" != "A simple web application" ]; then + echo "❌ Chart description is not set to 'A simple web application'" + echo "Current description: $description" + exit 1 +fi + +# Check if the appVersion is set correctly +app_version=$(grep "appVersion:" webapp/Chart.yaml | sed 's/appVersion: //g' | tr -d '"' | tr -d "'" | xargs) +if [ "$app_version" != "1.2.3" ]; then + echo "❌ Chart appVersion is not set to '1.2.3'" + echo "Current appVersion: $app_version" + exit 1 +fi + +echo "✅ Chart.yaml is modified correctly with the required metadata" +echo "Chart.yaml content:" +cat webapp/Chart.yaml +exit 0 \ No newline at end of file diff --git a/facilitator/src/services/metricService.js b/facilitator/src/services/metricService.js index 29f70a7..54ed484 100644 --- a/facilitator/src/services/metricService.js +++ b/facilitator/src/services/metricService.js @@ -23,7 +23,7 @@ class MetricService { if (!this.TRACK_METRICS) return; try { const metricData = { - id: examId, + examId: examId, timestamp: new Date().toISOString(), ...data }; diff --git a/facilitator/src/utils/logger.js b/facilitator/src/utils/logger.js index aad9cb7..dc7b946 100644 --- a/facilitator/src/utils/logger.js +++ b/facilitator/src/utils/logger.js @@ -23,9 +23,13 @@ const logger = winston.createLogger({ ({ level, message, timestamp, ...metadata }) => { let msg = `${timestamp} [${level}]: ${message}`; - // Add metadata if exists - if (Object.keys(metadata).length > 0 && metadata.service) { - msg += JSON.stringify(metadata); + try { + // Add metadata if exists + if (Object.keys(metadata).length > 0 && metadata.service) { + msg += JSON.stringify(metadata); + } + } catch (error) { + console.error('Error in logger:', error); } return msg; diff --git a/facilitator/src/utils/redisClient.js b/facilitator/src/utils/redisClient.js index af0a458..0af7ebd 100644 --- a/facilitator/src/utils/redisClient.js +++ b/facilitator/src/utils/redisClient.js @@ -55,7 +55,7 @@ async function getClient() { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function persistExamInfo(examId, examInfo, ttl = 3600) { +async function persistExamInfo(examId, examInfo, ttl = 36000) { try { const client = await getClient(); const key = `${KEYS.EXAM_INFO}${examId}`; @@ -76,7 +76,7 @@ async function persistExamInfo(examId, examInfo, ttl = 3600) { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function persistExamStatus(examId, status, ttl = 3600) { +async function persistExamStatus(examId, status, ttl = 36000) { try { const client = await getClient(); const key = `${KEYS.EXAM_STATUS}${examId}`; @@ -96,7 +96,7 @@ async function persistExamStatus(examId, status, ttl = 3600) { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function persistExamResult(examId, result, ttl = 3600) { +async function persistExamResult(examId, result, ttl = 36000) { try { const client = await getClient(); const key = `${KEYS.EXAM_RESULT}${examId}`; @@ -117,7 +117,7 @@ async function persistExamResult(examId, result, ttl = 3600) { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function setCurrentExamId(examId, ttl = 3600) { +async function setCurrentExamId(examId, ttl = 36000) { try { const client = await getClient(); const result = await client.setEx(KEYS.CURRENT_EXAM_ID, ttl, examId); @@ -200,8 +200,8 @@ async function getCurrentExamId() { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function updateExamInfo(examId, examInfo, ttl = 3600) { - return persistExamInfo(examId, examInfo, ttl); +async function updateExamInfo(examId, examInfo) { + return persistExamInfo(examId, examInfo); } /** @@ -211,8 +211,8 @@ async function updateExamInfo(examId, examInfo, ttl = 3600) { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function updateExamStatus(examId, status, ttl = 3600) { - return persistExamStatus(examId, status, ttl); +async function updateExamStatus(examId, status) { + return persistExamStatus(examId, status); } /** @@ -221,8 +221,8 @@ async function updateExamStatus(examId, status, ttl = 3600) { * @param {number} [ttl=3600] - Time to live in seconds (default: 1 hour) * @returns {Promise} - Returns 'OK' if successful */ -async function updateCurrentExamId(examId, ttl = 3600) { - return setCurrentExamId(examId, ttl); +async function updateCurrentExamId(examId) { + return setCurrentExamId(examId); } /** diff --git a/jumphost/Dockerfile b/jumphost/Dockerfile index 252ab0a..355bb9d 100644 --- a/jumphost/Dockerfile +++ b/jumphost/Dockerfile @@ -17,7 +17,8 @@ RUN apt-get update && apt-get install -y \ vim \ bash-completion\ nano \ - docker.io + docker.io\ + jq #kubectl diff --git a/jumphost/scripts/cleanup-exam-env.sh b/jumphost/scripts/cleanup-exam-env.sh index 81930b3..954c2eb 100644 --- a/jumphost/scripts/cleanup-exam-env.sh +++ b/jumphost/scripts/cleanup-exam-env.sh @@ -21,10 +21,18 @@ ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null candidate@k8s-ap #cleanup docker env log "Cleaning up docker environment" docker system prune -a --volumes -f +docker rm -f $(docker ps -a -q) +docker rmi -f $(docker images -q) +docker volume rm $(docker volume ls -q) +docker network rm $(docker network ls -q) +docker container rm $(docker container ls -q) +docker image rm $(docker image ls -q) +docker volume rm $(docker volume ls -q) # Remove the exam environment directory log "Removing exam environment directory" rm -rf /tmp/exam-env +rm -rf /tmp/exam # Remove the exam assets directory log "Removing exam assets directory" diff --git a/remote-desktop/Dockerfile b/remote-desktop/Dockerfile index bb9e7e6..7706cfc 100644 --- a/remote-desktop/Dockerfile +++ b/remote-desktop/Dockerfile @@ -43,6 +43,6 @@ RUN echo "UserKnownHostsFile /dev/null" >> /home/candidate/.ssh/config COPY startup.sh /usr/local/bin/startup.sh RUN chmod +x /usr/local/bin/startup.sh -COPY agent.py /home/candidate/agent.py +COPY agent.py /tmp/agent.py RUN sed -i '/### every exit != 0 fails the script/a /usr/local/bin/startup.sh' /dockerstartup/vnc_startup.sh \ No newline at end of file diff --git a/remote-desktop/startup.sh b/remote-desktop/startup.sh index 1949228..612c64e 100644 --- a/remote-desktop/startup.sh +++ b/remote-desktop/startup.sh @@ -6,6 +6,6 @@ echo "Starting CKAD VNC service at $(date)" echo "echo 'Use Ctrl + Shift + C for copying and Ctrl + Shift + V for pasting'" >> /home/candidate/.bashrc # Run in the background - don't block the main container startup -python3 /home/candidate/agent.py & +python3 /tmp/agent.py & exit 0 \ No newline at end of file diff --git a/scripts/COMPOSE-DEPLOY.md b/scripts/COMPOSE-DEPLOY.md index 4f02635..6970284 100644 --- a/scripts/COMPOSE-DEPLOY.md +++ b/scripts/COMPOSE-DEPLOY.md @@ -17,7 +17,7 @@ This guide provides instructions for deploying the CK-X Simulator on different o Open Terminal and run: ```bash -bash <(curl -fsSL https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/install.sh) +bash <(curl -fsSL https://raw.githubusercontent.com/nishanb/CK-X/master/scripts/install.sh) ``` ### Windows @@ -25,7 +25,7 @@ bash <(curl -fsSL https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/in Open PowerShell as Administrator and run: ```powershell -irm https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/install.ps1 | iex +irm https://raw.githubusercontent.com/nishanb/CK-X/master/scripts/install.ps1 | iex ``` ## Manual Installation @@ -34,7 +34,7 @@ irm https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/install.ps1 | ie 1. Clone the repository: ```bash - git clone https://github.com/nishanb/ck-x.git + git clone https://github.com/nishanb/CK-X.git cd ck-x ``` @@ -48,8 +48,8 @@ irm https://raw.githubusercontent.com/nishanb/ck-x/main/scripts/install.ps1 | ie If you prefer to install manually or the quick install doesn't work: 1. Download the installation script: - - Linux/macOS: [install.sh](https://raw.githubusercontent.com/nishanb/ck-x/main/script/install.sh) - - Windows: [install.ps1](https://raw.githubusercontent.com/nishanb/ck-x/main/script/install.ps1) + - Linux/macOS: [install.sh](https://raw.githubusercontent.com/nishanb/CK-X/master/scripts/install.sh) + - Windows: [install.ps1](https://raw.githubusercontent.com/nishanb/CK-X/master/scripts/install.ps1) 2. Run the script: - Linux/macOS: @@ -118,7 +118,7 @@ docker compose up -d If you encounter issues: 1. Check the logs: `docker compose logs -f` -2. Visit our [GitHub Issues](https://github.com/nishanb/ck-x/issues) +2. Visit our [GitHub Issues](https://github.com/nishanb/CK-X/issues) 3. Contact support with logs and system information ## Uninstallation diff --git a/scripts/house-keeping/build-and-push.sh b/scripts/house-keeping/build-and-push.sh index 1bb5a50..2ec0ff1 100755 --- a/scripts/house-keeping/build-and-push.sh +++ b/scripts/house-keeping/build-and-push.sh @@ -2,15 +2,18 @@ # Script to build and push Docker images for CK-X Simulator # This script builds all images defined in the compose.yaml file and pushes them to Docker Hub +# Supports multi-architecture builds (linux/amd64 and linux/arm64) # Set variables DOCKER_HUB_USERNAME=${DOCKER_HUB_USERNAME:-nishanb} REGISTRY="${DOCKER_HUB_USERNAME}" SKIP_LOGIN_CHECK=${SKIP_LOGIN_CHECK:-false} +PLATFORMS="linux/amd64,linux/arm64" # Get the script directory to handle relative paths correctly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -PROJECT_ROOT="$(dirname "$SCRIPT_DIR")" +PROJECT_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")" +echo "PROJECT_ROOT: ${PROJECT_ROOT}" # Define color codes for output RED='\033[0;31m' @@ -24,6 +27,30 @@ echo -e "${GREEN} CK-X Simulator - Build & Push Tool ${NC}" echo -e "${GREEN}=======================================${NC}" echo +# Check if buildx is available +echo -e "${YELLOW}Checking Docker buildx availability...${NC}" +if ! docker buildx version > /dev/null 2>&1; then + echo -e "${RED}Docker buildx is not available. Please ensure you have Docker 19.03 or newer with experimental features enabled.${NC}" + exit 1 +fi +echo -e "${GREEN}Docker buildx is available.${NC}" + +# Create a new builder instance if it doesn't exist +BUILDER_NAME="ck-x-multiarch-builder" +if ! docker buildx inspect ${BUILDER_NAME} > /dev/null 2>&1; then + echo -e "${YELLOW}Creating new buildx builder: ${BUILDER_NAME}${NC}" + docker buildx create --name ${BUILDER_NAME} --use --bootstrap +else + echo -e "${YELLOW}Using existing buildx builder: ${BUILDER_NAME}${NC}" + docker buildx use ${BUILDER_NAME} +fi + +# Ensure the builder is running +echo -e "${YELLOW}Bootstrapping buildx builder...${NC}" +docker buildx inspect --bootstrap +echo -e "${GREEN}Buildx builder is ready.${NC}" +echo + # Check if user is logged in to Docker Hub (with option to skip) if [ "$SKIP_LOGIN_CHECK" != "true" ]; then echo -e "${YELLOW}Checking Docker Hub login status...${NC}" @@ -75,14 +102,15 @@ TAG="${TAG_INPUT:-latest}" echo -e "${GREEN}Using tag: ${TAG}${NC}" echo -# Function to build and push a single image +# Function to build and push a single image with multi-architecture support build_and_push() { local COMPONENT=$1 local CONTEXT_PATH=$2 local IMAGE_NAME="${REGISTRY}/ck-x-simulator-${COMPONENT}:${TAG}" - echo -e "${YELLOW}Building image: ${IMAGE_NAME}${NC}" + echo -e "${YELLOW}Building multi-architecture image: ${IMAGE_NAME}${NC}" echo -e "Context path: ${CONTEXT_PATH}" + echo -e "Platforms: ${PLATFORMS}" # Check if the context path exists if [ ! -d "${CONTEXT_PATH}" ]; then @@ -90,24 +118,18 @@ build_and_push() { exit 1 fi - # Build the image - docker build -t ${IMAGE_NAME} ${CONTEXT_PATH} + # Build and push the multi-architecture image in one command + echo -e "${YELLOW}Building and pushing image for multiple architectures...${NC}" + docker buildx build \ + --platform=${PLATFORMS} \ + --tag ${IMAGE_NAME} \ + --push \ + ${CONTEXT_PATH} if [ $? -eq 0 ]; then - echo -e "${GREEN}Successfully built ${IMAGE_NAME}${NC}" - - # Push the image - echo -e "${YELLOW}Pushing image: ${IMAGE_NAME}${NC}" - docker push ${IMAGE_NAME} - - if [ $? -eq 0 ]; then - echo -e "${GREEN}Successfully pushed ${IMAGE_NAME}${NC}" - else - echo -e "${RED}Failed to push ${IMAGE_NAME}${NC}" - exit 1 - fi + echo -e "${GREEN}Successfully built and pushed ${IMAGE_NAME} for platforms: ${PLATFORMS}${NC}" else - echo -e "${RED}Failed to build ${IMAGE_NAME}${NC}" + echo -e "${RED}Failed to build/push ${IMAGE_NAME}${NC}" exit 1 fi @@ -115,7 +137,7 @@ build_and_push() { } # Confirm before proceeding -echo -e "${YELLOW}This script will build and push the following images with tag '${TAG}':${NC}" +echo -e "${YELLOW}This script will build and push the following multi-architecture images (${PLATFORMS}) with tag '${TAG}':${NC}" echo " - ${REGISTRY}/ck-x-simulator-remote-desktop:${TAG}" echo " - ${REGISTRY}/ck-x-simulator-webapp:${TAG}" echo " - ${REGISTRY}/ck-x-simulator-nginx:${TAG}" @@ -132,7 +154,7 @@ if [[ ! $REPLY =~ ^[Yy]$ ]]; then fi # Build and push each image -echo -e "${GREEN}Starting build and push process...${NC}" +echo -e "${GREEN}Starting multi-architecture build and push process...${NC}" echo # Remote Desktop @@ -157,8 +179,9 @@ build_and_push "cluster" "${PROJECT_ROOT}/kind-cluster" build_and_push "facilitator" "${PROJECT_ROOT}/facilitator" echo -e "${GREEN}=======================================${NC}" -echo -e "${GREEN} All images built and pushed successfully! ${NC}" +echo -e "${GREEN} All multi-architecture images built and pushed successfully! ${NC}" echo -e "${GREEN} Tag: ${TAG} ${NC}" +echo -e "${GREEN} Platforms: ${PLATFORMS} ${NC}" echo -e "${GREEN}=======================================${NC}" # Done diff --git a/scripts/install.ps1 b/scripts/install.ps1 index 883aaf6..6240f6c 100644 --- a/scripts/install.ps1 +++ b/scripts/install.ps1 @@ -1,319 +1,369 @@ # PowerShell script for installing CK-X Simulator # Requires PowerShell 5.0 or higher -# Color definitions for output -$Red = [System.Console]::ForegroundColor = "Red" -$Green = [System.Console]::ForegroundColor = "Green" -$Yellow = [System.Console]::ForegroundColor = "Yellow" -$Blue = [System.Console]::ForegroundColor = "Blue" -$Cyan = [System.Console]::ForegroundColor = "Cyan" -$DefaultColor = [System.Console]::ResetColor() +try { + # Color definitions for output + $Red = [System.Console]::ForegroundColor = "Red" + $Green = [System.Console]::ForegroundColor = "Green" + $Yellow = [System.Console]::ForegroundColor = "Yellow" + $Blue = [System.Console]::ForegroundColor = "Blue" + $Cyan = [System.Console]::ForegroundColor = "Cyan" + $DefaultColor = [System.Console]::ResetColor() -# Function to print colored text -function Write-ColorOutput { - param ( - [string]$Message, - [string]$Color - ) - - if ($Color -eq "Red") { - Write-Host $Message -ForegroundColor Red - } elseif ($Color -eq "Green") { - Write-Host $Message -ForegroundColor Green - } elseif ($Color -eq "Yellow") { - Write-Host $Message -ForegroundColor Yellow - } elseif ($Color -eq "Blue") { - Write-Host $Message -ForegroundColor Blue - } elseif ($Color -eq "Cyan") { - Write-Host $Message -ForegroundColor Cyan - } else { - Write-Host $Message - } -} - -# ASCII Art and Description -function Print-Header { - Write-ColorOutput "`n" "Blue" - Write-ColorOutput "░█████╗░██╗░░██╗░░░░░░██╗░░██╗ ░██████╗██╗███╗░░░███╗██╗░░░██╗██╗░░░░░░█████╗░████████╗░█████╗░██████╗░" "Blue" - Write-ColorOutput "██╔══██╗██║░██╔╝░░░░░░╚██╗██╔╝ ██╔════╝██║████╗░████║██║░░░██║██║░░░░░██╔══██╗╚══██╔══╝██╔══██╗██╔══██╗" "Blue" - Write-ColorOutput "██║░░╚═╝█████═╝░█████╗░╚███╔╝░ ╚█████╗░██║██╔████╔██║██║░░░██║██║░░░░░███████║░░░██║░░░██║░░██║██████╔╝" "Blue" - Write-ColorOutput "██║░░██╗██╔═██╗░╚════╝░██╔██╗░ ░╚═══██╗██║██║╚██╔╝██║██║░░░██║██║░░░░░██╔══██║░░░██║░░░██║░░██║██╔══██╗" "Blue" - Write-ColorOutput "╚█████╔╝██║░╚██╗░░░░░░██╔╝╚██╗ ██████╔╝██║██║░╚═╝░██║╚██████╔╝███████╗██║░░██║░░░██║░░░╚█████╔╝██║░░██║" "Blue" - Write-ColorOutput "░╚════╝░╚═╝░░╚═╝░░░░░░╚═╝░░╚═╝ ╚═════╝░╚═╝╚═╝░░░░░╚═╝░╚═════╝░╚══════╝╚═╝░░╚═╝░░░╚═╝░░░░╚════╝░╚═╝░░╚═╝" "Blue" - Write-ColorOutput "`n" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - Write-ColorOutput "CK-X Simulator: Kubernetes Certification Exam Simulator" "Cyan" - Write-ColorOutput "Practice in a realistic environment for CKA, CKAD, and more" "Cyan" - Write-ColorOutput "==============================================================" "Cyan" - Write-ColorOutput " Facing any issues? Please report at: https://github.com/nishanb/ck-x/issues" "Cyan" - Write-Host "" -} - -# Function to check if running as administrator -function Test-Administrator { - $user = [Security.Principal.WindowsIdentity]::GetCurrent() - $principal = New-Object Security.Principal.WindowsPrincipal $user - return $principal.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) -} - -# Function to check if a command exists -function Test-Command { - param($Command) - return [bool](Get-Command -Name $Command -ErrorAction SilentlyContinue) -} - -# Function to check if Docker is running -function Test-DockerRunning { - try { - $dockerInfo = docker info 2>&1 - if ($LASTEXITCODE -eq 0) { - return $true + # Function to print colored text + function Write-ColorOutput { + param ( + [string]$Message, + [string]$Color + ) + + if ($Color -eq "Red") { + Write-Host $Message -ForegroundColor Red + } elseif ($Color -eq "Green") { + Write-Host $Message -ForegroundColor Green + } elseif ($Color -eq "Yellow") { + Write-Host $Message -ForegroundColor Yellow + } elseif ($Color -eq "Blue") { + Write-Host $Message -ForegroundColor Blue + } elseif ($Color -eq "Cyan") { + Write-Host $Message -ForegroundColor Cyan } else { + Write-Host $Message + } + } + + # ASCII Art and Description + function Print-Header { + Write-ColorOutput "`n" "Blue" + Write-ColorOutput "░█████╗░██╗░░██╗░░░░░░██╗░░██╗ ░██████╗██╗███╗░░░███╗██╗░░░██╗██╗░░░░░░█████╗░████████╗░█████╗░██████╗░" "Blue" + Write-ColorOutput "██╔══██╗██║░██╔╝░░░░░░╚██╗██╔╝ ██╔════╝██║████╗░████║██║░░░██║██║░░░░░██╔══██╗╚══██╔══╝██╔══██╗██╔══██╗" "Blue" + Write-ColorOutput "██║░░╚═╝█████═╝░█████╗░╚███╔╝░ ╚█████╗░██║██╔████╔██║██║░░░██║██║░░░░░███████║░░░██║░░░██║░░██║██████╔╝" "Blue" + Write-ColorOutput "██║░░██╗██╔═██╗░╚════╝░██╔██╗░ ░╚═══██╗██║██║╚██╔╝██║██║░░░██║██║░░░░░██╔══██║░░░██║░░░██║░░██║██╔══██╗" "Blue" + Write-ColorOutput "╚█████╔╝██║░╚██╗░░░░░░██╔╝╚██╗ ██████╔╝██║██║░╚═╝░██║╚██████╔╝███████╗██║░░██║░░░██║░░░╚█████╔╝██║░░██║" "Blue" + Write-ColorOutput "░╚════╝░╚═╝░░╚═╝░░░░░░╚═╝░░╚═╝ ╚═════╝░╚═╝╚═╝░░░░░╚═╝░╚═════╝░╚══════╝╚═╝░░╚═╝░░░╚═╝░░░░╚════╝░╚═╝░░╚═╝" "Blue" + Write-ColorOutput "`n" "Blue" + Write-ColorOutput "==============================================================" "Cyan" + Write-ColorOutput "CK-X Simulator: Kubernetes Certification Exam Simulator" "Cyan" + Write-ColorOutput "Practice in a realistic environment for CKA, CKAD, and more" "Cyan" + Write-ColorOutput "==============================================================" "Cyan" + Write-ColorOutput " Facing any issues? Please report at: https://github.com/nishanb/CK-X/issues" "Cyan" + Write-Host "" + } + + # Function to check if running as administrator + function Test-Administrator { + $user = [Security.Principal.WindowsIdentity]::GetCurrent() + $principal = New-Object Security.Principal.WindowsPrincipal $user + return $principal.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) + } + + # Function to check if a command exists + function Test-Command { + param($Command) + return [bool](Get-Command -Name $Command -ErrorAction SilentlyContinue) + } + + # Function to check if Docker is running + function Test-DockerRunning { + try { + $dockerInfo = docker info 2>&1 + if ($LASTEXITCODE -eq 0) { + return $true + } else { + return $false + } + } catch { return $false } - } catch { - return $false } -} -# Function to check system requirements -function Check-Requirements { - Write-ColorOutput "Checking System Requirements" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - - # Check if running as administrator - if (-not (Test-Administrator)) { - Write-ColorOutput "✗ This script must be run as Administrator" "Red" - Write-ColorOutput "Please right-click PowerShell and select 'Run as Administrator'" "Yellow" - exit 1 - } - Write-ColorOutput "✓ Running with Administrator privileges" "Green" - - # Check Docker Desktop - if (-not (Test-Command docker)) { - Write-ColorOutput "✗ Docker is not installed" "Red" - Write-ColorOutput "Please install Docker Desktop first:" "Yellow" - Write-ColorOutput "Visit https://docs.docker.com/desktop/windows/install/ for installation instructions." "Cyan" - exit 1 - } - Write-ColorOutput "✓ Docker is installed" "Green" - - # Check if Docker is running - if (-not (Test-DockerRunning)) { - Write-ColorOutput "✗ Docker is not running" "Red" - Write-ColorOutput "Please start Docker and try again:" "Yellow" - Write-ColorOutput "1. Open Docker Desktop" "Cyan" - Write-ColorOutput "2. Wait for Docker to start" "Cyan" - Write-ColorOutput "3. Run this script again" "Cyan" - exit 1 - } - Write-ColorOutput "" "" - - # Check Docker Compose (built into Docker Desktop for Windows) - $composeTest = docker compose version 2>&1 - if ($LASTEXITCODE -ne 0) { - Write-ColorOutput "✗ Docker Compose is not installed or not working properly" "Red" - Write-ColorOutput "Please ensure Docker Desktop is properly installed with Docker Compose" "Yellow" - exit 1 - } - Write-ColorOutput "✓ Docker Compose is installed" "Green" - - # Check curl or equivalent - if (-not (Test-Command curl) -and -not (Test-Command Invoke-WebRequest)) { - Write-ColorOutput "✗ Neither curl nor Invoke-WebRequest is available" "Red" - Write-ColorOutput "Please ensure you have PowerShell 3.0 or higher" "Yellow" - exit 1 - } - Write-ColorOutput "✓ Download capabilities are available" "Green" - - Write-ColorOutput "✓ All system requirements satisfied" "Green" - Write-Host "" -} - -# Function to check if ports are available -function Check-Ports { - $port = 30080 - - Write-ColorOutput "Checking Port Availability" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - - try { - # Check if port is in use - $portInUse = $false - $connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -eq $port} + # Function to check system requirements + function Check-Requirements { + Write-ColorOutput "Checking System Requirements" "Blue" + Write-ColorOutput "==============================================================" "Cyan" - if ($connections) { - $portInUse = $true - } else { - # Try to create a TCP listener as a secondary check - $listener = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Any, $port) - try { - $listener.Start() - $listener.Stop() - } catch { + # Check if running as administrator + if (-not (Test-Administrator)) { + Write-ColorOutput "✗ This script must be run as Administrator" "Red" + Write-ColorOutput "Please right-click PowerShell and select 'Run as Administrator'" "Yellow" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return $false + } + Write-ColorOutput "✓ Running with Administrator privileges" "Green" + + # Check Docker Desktop + if (-not (Test-Command docker)) { + Write-ColorOutput "✗ Docker is not installed" "Red" + Write-ColorOutput "Please install Docker Desktop first:" "Yellow" + Write-ColorOutput "Visit https://docs.docker.com/desktop/windows/install/ for installation instructions." "Cyan" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return $false + } + Write-ColorOutput "✓ Docker is installed" "Green" + + # Check if Docker is running + if (-not (Test-DockerRunning)) { + Write-ColorOutput "✗ Docker is not running" "Red" + Write-ColorOutput "Please start Docker and try again:" "Yellow" + Write-ColorOutput "1. Open Docker Desktop" "Cyan" + Write-ColorOutput "2. Wait for Docker to start" "Cyan" + Write-ColorOutput "3. Run this script again" "Cyan" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return $false + } + Write-ColorOutput "" "" + + # Check Docker Compose (built into Docker Desktop for Windows) + $composeTest = docker compose version 2>&1 + if ($LASTEXITCODE -ne 0) { + Write-ColorOutput "✗ Docker Compose is not installed or not working properly" "Red" + Write-ColorOutput "Please ensure Docker Desktop is properly installed with Docker Compose" "Yellow" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return $false + } + Write-ColorOutput "✓ Docker Compose is installed" "Green" + + # Check curl or equivalent + if (-not (Test-Command curl) -and -not (Test-Command Invoke-WebRequest)) { + Write-ColorOutput "✗ Neither curl nor Invoke-WebRequest is available" "Red" + Write-ColorOutput "Please ensure you have PowerShell 3.0 or higher" "Yellow" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return $false + } + Write-ColorOutput "✓ Download capabilities are available" "Green" + + Write-ColorOutput "✓ All system requirements satisfied" "Green" + Write-Host "" + return $true + } + + # Function to check if ports are available + function Check-Ports { + $port = 30080 + + Write-ColorOutput "Checking Port Availability" "Blue" + Write-ColorOutput "==============================================================" "Cyan" + + try { + # Check if port is in use + $portInUse = $false + $connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -eq $port} + + if ($connections) { $portInUse = $true + } else { + # Try to create a TCP listener as a secondary check + $listener = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Any, $port) + try { + $listener.Start() + $listener.Stop() + } catch { + $portInUse = $true + } } - } - - if ($portInUse) { - Write-ColorOutput "✗ Port $port is already in use" "Red" - Write-ColorOutput "Please free this port and try again" "Yellow" - exit 1 - } - - Write-ColorOutput "✓ Port $port is available" "Green" - Write-Host "" - } catch { - Write-ColorOutput "Warning: Could not reliably check port availability" "Yellow" - Write-Host "" - } -} - -# Function to wait for service health -function Wait-ForService { - param($Service) - $maxAttempts = 30 - $attempt = 1 - - while ($attempt -le $maxAttempts) { - $health = docker compose ps $Service | Select-String "healthy" - if ($health) { + + if ($portInUse) { + Write-ColorOutput "✗ Port $port is already in use" "Red" + Write-ColorOutput "Please free this port and try again" "Yellow" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return $false + } + + Write-ColorOutput "✓ Port $port is available" "Green" + Write-Host "" + return $true + } catch { + Write-ColorOutput "Warning: Could not reliably check port availability" "Yellow" + Write-Host "" return $true } - Start-Sleep -Seconds 2 - $attempt++ } - - Write-ColorOutput "✗ Timeout waiting for $Service to be ready" "Red" - return $false -} -# Function to open browser -function Open-Browser { - $url = "http://localhost:30080" - Write-ColorOutput "Opening Browser" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - - try { - Start-Process $url - Write-ColorOutput "✓ Browser opened successfully" "Green" - return $true - } catch { + # Function to wait for service health + function Wait-ForService { + param($Service) + $maxAttempts = 30 + $attempt = 1 + + while ($attempt -le $maxAttempts) { + $health = docker compose ps $Service | Select-String "healthy" + if ($health) { + return $true + } + Start-Sleep -Seconds 2 + $attempt++ + } + + Write-ColorOutput "✗ Timeout waiting for $Service to be ready" "Red" + return $false + } + + # Function to open browser + function Open-Browser { + $url = "http://localhost:30080" + Write-ColorOutput "Opening Browser" "Blue" + Write-ColorOutput "==============================================================" "Cyan" + try { - [System.Diagnostics.Process]::Start("cmd", "/c start $url") + Start-Process $url Write-ColorOutput "✓ Browser opened successfully" "Green" return $true } catch { - Write-ColorOutput "Could not automatically open browser. Please visit:" "Yellow" - Write-ColorOutput "http://localhost:30080" "Green" - return $false + try { + [System.Diagnostics.Process]::Start("cmd", "/c start $url") + Write-ColorOutput "✓ Browser opened successfully" "Green" + return $true + } catch { + Write-ColorOutput "Could not automatically open browser. Please visit:" "Yellow" + Write-ColorOutput "http://localhost:30080" "Green" + return $false + } } } -} -# Main installation function -function Install-CKX { - Print-Header - - # Check requirements - Check-Requirements - - # Check port - Check-Ports - - # Create project directory - Write-ColorOutput "Setting Up Installation" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - Write-ColorOutput "Creating project directory..." "Yellow" - - $installDir = "ck-x-simulator" - if (-not (Test-Path $installDir)) { - New-Item -ItemType Directory -Force -Path $installDir | Out-Null + # Main installation function + function Install-CKX { + Print-Header + + # Check requirements + $requirementsCheck = Check-Requirements + if (-not $requirementsCheck) { + Write-ColorOutput "Installation cannot proceed due to unmet requirements." "Red" + return + } + + # Check port + $portsCheck = Check-Ports + if (-not $portsCheck) { + Write-ColorOutput "Installation cannot proceed due to port issues." "Red" + return + } + + # Create project directory + Write-ColorOutput "Setting Up Installation" "Blue" + Write-ColorOutput "==============================================================" "Cyan" + Write-ColorOutput "Creating project directory..." "Yellow" + + $installDir = "ck-x-simulator" + if (-not (Test-Path $installDir)) { + New-Item -ItemType Directory -Force -Path $installDir | Out-Null + } + Set-Location $installDir + + # Download docker-compose.yml + Write-ColorOutput "Downloading Docker Compose file..." "Yellow" + $composeUrl = "https://raw.githubusercontent.com/nishanb/ck-x/master/docker-compose.yaml" + + if (Test-Command curl) { + curl.exe -fsSL $composeUrl -o docker-compose.yml + } else { + Invoke-WebRequest -Uri $composeUrl -OutFile docker-compose.yml + } + + if (-not (Test-Path "docker-compose.yml")) { + Write-ColorOutput "✗ Failed to download docker-compose.yml" "Red" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return + } + Write-ColorOutput "✓ Docker Compose file downloaded" "Green" + + # Pull images + Write-ColorOutput "Pulling Docker images..." "Yellow" + docker compose pull + if ($LASTEXITCODE -ne 0) { + Write-ColorOutput "✗ Failed to pull Docker images" "Red" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return + } + Write-ColorOutput "✓ Docker images pulled successfully" "Green" + + # Start services + Write-ColorOutput "Starting CK-X services..." "Yellow" + docker compose up -d + if ($LASTEXITCODE -ne 0) { + Write-ColorOutput "✗ Failed to start services" "Red" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return + } + Write-ColorOutput "✓ Services started" "Green" + + # Wait for services + Write-ColorOutput "Waiting for services to initialize..." "Yellow" + $webappReady = Wait-ForService "webapp" + if (-not $webappReady) { + Write-ColorOutput "Installation cannot proceed as webapp service is not ready." "Red" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return + } + + $facilitatorReady = Wait-ForService "facilitator" + if (-not $facilitatorReady) { + Write-ColorOutput "Installation cannot proceed as facilitator service is not ready." "Red" + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + return + } + + Write-ColorOutput "✓ All services initialized successfully" "Green" + + Write-Host "" + Write-ColorOutput "Installation Complete!" "Blue" + Write-ColorOutput "==============================================================" "Cyan" + Write-ColorOutput "✓ CK-X Simulator has been installed successfully" "Green" + + # Wait a bit for the service to be fully ready + Start-Sleep -Seconds 5 + + # Try to open browser + Open-Browser + + Write-Host "" + Write-ColorOutput "Useful Commands" "Blue" + Write-ColorOutput "==============================================================" "Cyan" + Write-ColorOutput "CK-X Simulator has been installed in: " -NoNewline + Write-ColorOutput "$(Get-Location), run all below commands from this directory" "Green" + Write-ColorOutput "To stop CK-X: " -NoNewline + Write-ColorOutput "docker compose down" "Green" + Write-ColorOutput "To Restart CK-X: " -NoNewline + Write-ColorOutput "docker compose restart" "Green" + Write-ColorOutput "To clean up all containers and images: " -NoNewline + Write-ColorOutput "docker system prune -a" "Green" + Write-ColorOutput "To remove only CK-X images: " -NoNewline + Write-ColorOutput "docker compose down --rmi all" "Green" + Write-Host "" + Write-ColorOutput "Thank you for installing CK-X Simulator!" "Cyan" } - Set-Location $installDir - - # Download docker-compose.yml - Write-ColorOutput "Downloading Docker Compose file..." "Yellow" - $composeUrl = "https://raw.githubusercontent.com/nishanb/ck-x/main/docker-compose.yml" - - if (Test-Command curl) { - curl.exe -fsSL $composeUrl -o docker-compose.yml + + # Check if running as Administrator + if (-not (Test-Administrator)) { + Write-Host "This script requires Administrator privileges. Please re-run as Administrator." -ForegroundColor Red + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") } else { - Invoke-WebRequest -Uri $composeUrl -OutFile docker-compose.yml + # Run the installation + try { + Install-CKX + } catch { + Write-Host "An error occurred during installation: $_" -ForegroundColor Red + Write-Host "Press any key to continue..." + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + } } - - if (-not (Test-Path "docker-compose.yml")) { - Write-ColorOutput "✗ Failed to download docker-compose.yml" "Red" - exit 1 - } - Write-ColorOutput "✓ Docker Compose file downloaded" "Green" - - # Pull images - Write-ColorOutput "Pulling Docker images..." "Yellow" - docker compose pull - if ($LASTEXITCODE -ne 0) { - Write-ColorOutput "✗ Failed to pull Docker images" "Red" - exit 1 - } - Write-ColorOutput "✓ Docker images pulled successfully" "Green" - - # Start services - Write-ColorOutput "Starting CK-X services..." "Yellow" - docker compose up -d - if ($LASTEXITCODE -ne 0) { - Write-ColorOutput "✗ Failed to start services" "Red" - exit 1 - } - Write-ColorOutput "✓ Services started" "Green" - - # Wait for services - Write-ColorOutput "Waiting for services to initialize..." "Yellow" - $webappReady = Wait-ForService "webapp" - if (-not $webappReady) { exit 1 } - - $facilitatorReady = Wait-ForService "facilitator" - if (-not $facilitatorReady) { exit 1 } - - Write-ColorOutput "✓ All services initialized successfully" "Green" - - Write-Host "" - Write-ColorOutput "Installation Complete!" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - Write-ColorOutput "✓ CK-X Simulator has been installed successfully" "Green" - - # Wait a bit for the service to be fully ready - Start-Sleep -Seconds 5 - - # Try to open browser - Open-Browser - - Write-Host "" - Write-ColorOutput "Useful Commands" "Blue" - Write-ColorOutput "==============================================================" "Cyan" - Write-ColorOutput "CK-X Simulator has been installed in: " -NoNewline - Write-ColorOutput "$(Get-Location), run all below commands from this directory" "Green" - Write-ColorOutput "To stop CK-X: " -NoNewline - Write-ColorOutput "docker compose down" "Green" - Write-ColorOutput "To Restart CK-X: " -NoNewline - Write-ColorOutput "docker compose restart" "Green" - Write-ColorOutput "To clean up all containers and images: " -NoNewline - Write-ColorOutput "docker system prune -a" "Green" - Write-ColorOutput "To remove only CK-X images: " -NoNewline - Write-ColorOutput "docker compose down --rmi all" "Green" - Write-Host "" - Write-ColorOutput "Thank you for installing CK-X Simulator!" "Cyan" -} - -# Check if running as Administrator -if (-not (Test-Administrator)) { - Write-Host "This script requires Administrator privileges. Please re-run as Administrator." -ForegroundColor Red - exit 1 -} - -# Run the installation -try { - Install-CKX } catch { - Write-Host "An error occurred during installation: $_" -ForegroundColor Red - exit 1 + # Global error handler + Write-Host "An unexpected error occurred: $_" -ForegroundColor Red +} finally { + # Ensure the window stays open even if there's an error + Write-Host "`n`nPress any key to exit..." -ForegroundColor Yellow + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") } \ No newline at end of file diff --git a/scripts/install.sh b/scripts/install.sh index 9f74147..0f719e0 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -23,7 +23,7 @@ print_header() { echo -e "${CYAN}CK-X Simulator: Kubernetes Certification Exam Simulator${NC}" echo -e "${CYAN}Practice in a realistic environment for CKA, CKAD, and more${NC}" echo -e "${CYAN}==============================================================${NC}" - echo -e "${CYAN} Facing any issues? Please report at: https://github.com/nishanb/ck-x/issues${NC}" + echo -e "${CYAN} Facing any issues? Please report at: https://github.com/nishanb/CK-X/issues${NC}" echo } @@ -184,7 +184,7 @@ main() { # Download docker-compose.yml echo -e "${YELLOW}Downloading Docker Compose file...${NC}" - curl -fsSL https://raw.githubusercontent.com/nishanb/ck-x/main/docker-compose.yml -o docker-compose.yml + curl -fsSL https://raw.githubusercontent.com/nishanb/ck-x/master/docker-compose.yaml -o docker-compose.yml if [ ! -f docker-compose.yml ]; then echo -e "${RED}✗ Failed to download docker-compose.yml${NC}"