mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Completed upto lesson 30

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-23 15:53:35 +06:00
parent 8e43c00cd6
commit f1b693a147
6 changed files with 21754 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
learning-records/0004-retrieval-profile-through-lesson-13.md
View File

@@ -17,6 +17,8 @@
- Completed focused RBAC remediation independently: narrowed an existing Role so its ServiceAccount retains ConfigMap read/watch access but cannot read Secrets or create ConfigMaps.
- Completed the first supplemental Istio security drill independently: namespace-wide `PeerAuthentication` uses the current v1 API and strict mTLS without an unnecessary selector or port exception.
- Completed supplemental Istio workload authorization after incremental review: an `ALLOW` policy selects only `payments-api`, grants only the exact `web-mesh/frontend` principal, and limits it to port `8080`.
- Completed node-metadata egress isolation after one correction: a single frontend egress policy permits only the payments API on TCP 8080 and CoreDNS on TCP/UDP 53, leaving metadata and other internet access denied.
- Completed SBOM generation and interpretation: produced a pinned-image CycloneDX JSON inventory with Syft and correctly distinguished component inventory from vulnerability or deployment-safety proof.
## Retrieval gaps to keep drilling