Completed upto lesson 28

lab/payments-hardening-sanswer.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: payments-prod
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: payments
+  namespace: payments-prod
+  labels:
+    app: payments
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 101
+    seccompProfile:
+      type: RuntimeDefault
+  volumes:
+    - name: secure-tmp
+      emptyDir: {}
+  containers:
+    - name: payments
+      image: nginxinc/nginx-unprivileged:1.27
+      volumeMounts:
+      - name: secure-tmp
+        mountPath: /tmp
+      ports:
+        - containerPort: 8080
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+
+        capabilities: 
+          drop: ["ALL"]