https://drive.google.com/file/d/15JhuuRPCbnmudauXmZQHLxtUBCE5RE2w/view?usp=sharing

🔍 Current YAML Breakdown

# 1. Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: unsecure
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: lovelearnlinux/unsecureapache:v1  # ← Custom Apache image
        ports:
        - containerPort: 8080                 # ← App listens on 8080

---
# 2. ClusterIP Service
apiVersion: v1
kind: Service
metadata:
  name: unsecure-svc
spec:
  selector:
    app: nginx
  ports:
    - port: 80          # ← Service port
      targetPort: 8080  # ← Pod port

---
# 3. NodePort Service
apiVersion: v1
kind: Service
metadata:
  name: unsecure-svc-np
spec:
  type: NodePort
  selector:
    app: nginx
  ports:
    - port: 8080
      targetPort: 8080
      nodePort: 30007   # ← Fixed NodePort (optional)

🔑 Key Observations:

• Two Services:
  • secure-svc → internal (ClusterIP)
  • secure-svc-np → external (NodePort: 30007)
• Port mapping: App runs on 8080 → exposed as 80 internally, 30007 externally

⚠️ Missing Security Features:

• No securityContext (run as non-root)
• No resource limits
• No probes
• No read-only root filesystem

🛠️ Enhanced Secure Version (Production-Ready)

Here’s how to harden this Deployment:

# secure-apache-enhanced.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      # 🔒 SECURITY: Run as non-root user
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000      # ← Must match image user
        fsGroup: 2000
      containers:
      - name: nginx
        image: lovelearnlinux/secureapache:v1  # ← Official NGINX image
        ports:
        - containerPort: 8080
        # 🔒 SECURITY: Container-level hardening
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 10
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 5

---
# ClusterIP Service (internal)
apiVersion: v1
kind: Service
metadata:
  name: secure-svc
spec:
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 8080

---
# NodePort Service (external)
apiVersion: v1
kind: Service
metadata:
  name: secure-svc-np
spec:
  type: NodePort
  selector:
    app: nginx
  ports:
  - port: 8080
    targetPort: 8080
    nodePort: 30007  # Optional: fixed port

✅ Key Security Enhancements:

• runAsNonRoot: true → prevents root access
• readOnlyRootFilesystem: true → blocks runtime writes
• drop ALL capabilities → minimal Linux capabilities
• Resource limits → prevents DoS
• Probes → ensures health

🧪 k3s Lab: Deploy Secure App + Test Access

🔧 Step 1: Deploy the Enhanced YAML

# Save as secure-apache-enhanced.yaml
kubectl apply -f secure-apache-enhanced.yaml

# Verify Pods
kubectl get pods -l app=nginx

🔧 Step 2: Test Internal Access (ClusterIP)

# Start debug Pod
kubectl run debug --image=curlimages/curl -it --rm -- sh

# Inside shell:
curl <http://secure-svc>
# ✅ Should return Apache welcome page

exit

🔧 Step 3: Test External Access (NodePort)

💡 In k3s, NodePort is accessible on any node’s IP.

# Get k3s node IPs
kubectl get nodes -o wide

# From your laptop (or any machine with network access to k3s nodes):
curl http://<NODE-IP>:30007
# Example: curl <http://192.168.1.10:30007>
# ✅ Should return Apache welcome page

🔍 Note:

• If you omit nodePort, k3s assigns a random port in 30000-32767
• Fixed nodePort is useful for firewall rules