mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

completed lesson 32

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-25 16:57:48 +06:00
parent 73093b9328
commit 639e69484c
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
lab/lesson-32-answer.md Normal file
View File

@@ -0,0 +1,24 @@
1. The failed request was an attempt by `system:serviceaccount:default:unknown`
to create ClusterRoleBinding `unknown-admin`. Response code `403` and status
`Failure` prove that the API server rejected the request.
2. the requested principle came from system:serviceaccount:checkout:release-bot
3. first successful escalation event is audit ID: b3, timestamp: 2026-08-25T04:22:11Z, verb: create, resourcetype: rolebindings, namespace: checkout, resourceName: release-bot-secret-reader
4. Secret `checkout/payment-gateway` was accessed successfully with a `get`
request that returned HTTP 200.
5. The principal opened a `pods/exec` session in Pod
`checkout/checkout-api-6d8f`; HTTP 101 shows the connection was upgraded.
6. First, delete RoleBinding
`checkout/release-bot-secret-reader` to revoke the escalated Secret access.
Second, isolate or stop the workload using ServiceAccount
`checkout/release-bot`, and terminate its access to Pod
`checkout/checkout-api-6d8f`.
Third, rotate the credential stored in Secret
`checkout/payment-gateway`, update its authorized consumers, and invalidate the
old credential.