Lesson 0027 · 25 minutes · Supply Chain Security

Find and prioritize insecure workload configuration

A static scan examines manifests before they reach the cluster. It is useful in CI because it catches risky workload settings early, but its findings still need human prioritization.

Timed task: 15 minutes

Scan lab/lesson-27-fixture.yaml with Trivy. Docker Desktop is sufficient; run:

docker run --rm -v ${PWD}:/work aquasec/trivy:0.68.1 config /work/lab/lesson-27-fixture.yaml

Create lab/lesson-27-answer.md. Do not modify the fixture.

Your answer must contain:

the exact scan command you ran;
three distinct findings from the manifest, in priority order;
one short sentence for each explaining why it increases risk; and
one concrete remediation for each finding.

Scope: report only manifest/configuration findings. Do not claim image-CVE results unless you also scanned an image. A tag such as latest is a deployment reproducibility and supply-chain issue, not proof of a CVE.

Retrieval check

Question

Why should CI scan both manifests and images?

They reveal different risks: manifests expose configuration risk, while images can expose package vulnerabilities and insecure contents.They always produce the same findings.A manifest scan replaces runtime monitoring.

Documentation target

Use the official Trivy configuration scanning documentation.

What to send me

Save the Markdown answer, then say done check. I’ll review one finding at a time and will not supply the whole answer unless you request it.