From 639e69484c2179bcbb92e3f83d8a27264efbe0be Mon Sep 17 00:00:00 2001 From: Mosiur Rahman Date: Tue, 25 Aug 2026 16:57:48 +0600 Subject: [PATCH] completed lesson 32 --- lab/lesson-32-answer.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 lab/lesson-32-answer.md diff --git a/lab/lesson-32-answer.md b/lab/lesson-32-answer.md new file mode 100644 index 0000000..938153f --- /dev/null +++ b/lab/lesson-32-answer.md @@ -0,0 +1,24 @@ +1. The failed request was an attempt by `system:serviceaccount:default:unknown` +to create ClusterRoleBinding `unknown-admin`. Response code `403` and status +`Failure` prove that the API server rejected the request. + +2. the requested principle came from system:serviceaccount:checkout:release-bot + +3. first successful escalation event is audit ID: b3, timestamp: 2026-08-25T04:22:11Z, verb: create, resourcetype: rolebindings, namespace: checkout, resourceName: release-bot-secret-reader + +4. Secret `checkout/payment-gateway` was accessed successfully with a `get` +request that returned HTTP 200. + +5. The principal opened a `pods/exec` session in Pod +`checkout/checkout-api-6d8f`; HTTP 101 shows the connection was upgraded. + +6. First, delete RoleBinding +`checkout/release-bot-secret-reader` to revoke the escalated Secret access. + +Second, isolate or stop the workload using ServiceAccount +`checkout/release-bot`, and terminate its access to Pod +`checkout/checkout-api-6d8f`. + +Third, rotate the credential stored in Secret +`checkout/payment-gateway`, update its authorized consumers, and invalidate the +old credential. \ No newline at end of file