Question 6: Verify Platform Binaries

Problem Statement

Solve this question on: ssh cks3477

There are four Kubernetes server binaries located at /opt/course/6/binaries on cks3477. You're provided with the following verified sha512 values for these:

kube-apiserver f417c0555bc0167355589dd1afe23be9bf909bf98312b1025f12015d1b58a1c62c9908c0067a7764fa35efdac7016a9efa8711a44425dd6692906a7c283f032c

kube-controller-manager 60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33boa8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60

kube-proxy 52f9d8ad045f8eee1d689619ef8ceef2d86d50c75a6a332653240d7ba5b2a114aca056d9e513984ade24358c9662714973c1960c62a5cb37dd375631c8a614c6

kubelet 4be40f2440619e990897cf956c32800dc96c2c983bf64519854a3309fa5aa21827991559f9c44595098e27e6f2ee4d64a3fdec6baba8a177881f20e3ec61e26c

Delete those binaries that don't match with the sha512 values above.

Solution

Step 1: Check Binary Files

➜ ssh cks3477 
➜ candidate@cks3477:~# cd /opt/course/6/binaries
➜ candidate@cks3477:/opt/course/6/binaries$ ls
kube-apiserver  kube-controller-manager  kube-proxy  kubelet

Step 2: Verify SHA512 Checksums

Check kube-apiserver:

➜ candidate@cks3477:/opt/course/6/binaries$ sha512sum kube-apiserver 
f417c0555bc0167355589dd1afe23be9bf909bf98312b1025f12015d1b58a1c62c9908c0067a7764fa35efdac7016a9efa8711a44425dd6692906a7c283f032c  kube-apiserver

Check kube-controller-manager:

➜ candidate@cks3477:/opt/course/6/binaries$ sha512sum kube-controller-manager
60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33b0a8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60  kube-controller-manager

Check kube-proxy:

➜ candidate@cks3477:/opt/course/6/binaries$ sha512sum kube-proxy
52f9d8ad045f8eee1d689619ef8ceef2d86d50c75a6a332653240d7ba5b2a114aca056d9e513984ade24358c9662714973c1960c62a5cb37dd375631c8a614c6  kube-proxy

Check kubelet:

➜ candidate@cks3477:/opt/course/6/binaries$ sha512sum kubelet
7b720598e6a3483b45c537b57d759e3e82bc5c53b3274f681792f62e941019cde3d51a7f9b55158abf3810d506146bc0aa7cf97b36f27f341028a54431b335be  kubelet

Step 3: Compare Controller Manager Hash

Let's compare the controller manager hash more carefully:

➜ candidate@cks3477:/opt/course/6/binaries$ sha512sum kube-controller-manager > compare
➜ candidate@cks3477:/opt/course/6/binaries$ vim compare 
# cks3477:/opt/course/6/binaries/compare
60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33b0a8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60  
60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33boa8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60

Check for differences:

➜ candidate@cks3477:/opt/course/6/binaries$ cat compare | uniq
60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33b0a8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60
60100cc725e91fe1a949e1b2d0474237844b5862556e25c2c655a33boa8225855ec5ee22fa4927e6c46a60d43a7c4403a27268f96fbb726307d1608b44f38a60

Step 4: Delete Invalid Binaries

Based on the checksum verification, we need to delete kubelet and kube-controller-manager:

➜ candidate@cks3477:/opt/course/6/binaries$ rm kubelet kube-controller-manager

The kube-controller-manager binary had a single character difference in its hash (0 vs o), and the kubelet binary had a completely different hash.

Back to Questions List