Completed upto lesson 35

lessons/0033-security-context-placement.html

@@ -0,0 +1,60 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Lesson 33: SecurityContext placement</title>
+  <link rel="stylesheet" href="../assets/course.css">
+</head>
+<body>
+<main>
+  <p class="eyebrow">Lesson 0033 · 25 minutes · Minimize Microservice Vulnerabilities</p>
+  <h1>Place hardening controls at the correct scope</h1>
+  <p class="lede">A correct control at the wrong YAML level is still an invalid solution. Harden both containers while preserving the sidecar's one required writable path.</p>
+
+  <h2>Timed task: 15 minutes</h2>
+  <p>Read <code>lab/lesson-33-fixture.yaml</code>. Create <code>lab/lesson-33-answer.yaml</code> from scratch. Preserve the namespace, Deployment name, replica count, selector, labels, container names, images, commands, and port.</p>
+  <p>Your completed Deployment must:</p>
+  <ul>
+    <li>run the Pod as non-root UID and GID <code>1000</code>;</li>
+    <li>apply <code>RuntimeDefault</code> seccomp to the whole Pod;</li>
+    <li>disable privilege escalation in both containers;</li>
+    <li>drop all Linux capabilities in both containers;</li>
+    <li>make both container root filesystems read-only; and</li>
+    <li>give only <code>log-exporter</code> a writable <code>emptyDir</code> mounted at <code>/var/cache/exporter</code>.</li>
+  </ul>
+  <p>Do not duplicate Pod-wide fields under each container, mount the writable volume into <code>api</code>, add capabilities, or change either image.</p>
+
+  <div class="callout"><strong>Placement reflex:</strong> identity and Pod-wide syscall policy belong under <code>template.spec.securityContext</code>. Privilege escalation, capabilities, and root-filesystem mutability belong under each entry in <code>template.spec.containers</code>.</div>
+
+  <h2>Verification</h2>
+  <pre><code>kubectl apply --dry-run=client -f .\lab\lesson-33-answer.yaml
+kubectl apply -f .\lab\lesson-33-answer.yaml
+kubectl -n context-lab rollout status deployment/report-api --timeout=90s
+kubectl -n context-lab exec deploy/report-api -c log-exporter -- test -f /var/cache/exporter/events.log
+kubectl -n context-lab exec deploy/report-api -c api -- sh -c 'touch /root/blocked'</code></pre>
+  <p>Expected: schema validation passes, the rollout completes, the sidecar writes its event file, and the API container cannot write to its root filesystem.</p>
+
+  <h2>Retrieval check</h2>
+  <div class="quiz">
+    <h3>Question</h3>
+    <p>Where does <code>readOnlyRootFilesystem</code> belong?</p>
+    <label><input type="radio" name="q" value="container">Inside each container's securityContext.</label>
+    <label><input type="radio" name="q" value="podspec">Directly under the Pod specification.</label>
+    <label><input type="radio" name="q" value="metadata">Inside the Pod template metadata.</label>
+    <button onclick="check()">Check answer</button>
+    <p id="feedback" class="feedback" aria-live="polite"></p>
+  </div>
+
+  <h2>Documentation target</h2>
+  <p>Use the official Kubernetes <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">security context documentation</a> after your first attempt. Use <code>kubectl explain deployment.spec.template.spec.securityContext</code> and <code>kubectl explain deployment.spec.template.spec.containers.securityContext</code> to confirm scope.</p>
+
+  <h2>What to send me</h2>
+  <p>Save the YAML, then say <em>check</em>. I will list all issues and help you correct only one per round. Ask me a follow-up question whenever a field's scope is unclear.</p>
+  <footer>Previous: <a href="0032-audit-success-vs-attempt.html">Audit success versus attempt</a> · CKS path: Minimize Microservice Vulnerabilities</footer>
+</main>
+<script>
+function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='container'){f.textContent='Correct. Root-filesystem mutability is configured per container.';f.className='feedback good';}else{f.textContent='Not quite. This control belongs in each container securityContext.';f.className='feedback bad';}}
+</script>
+</body>
+</html>