Completed upto lesson 30

CKS-SYLLABUS.md

@@ -54,7 +54,7 @@ Official sources: [CNCF curriculum repository](https://github.com/cncf/curriculu
 | Cluster Hardening | 3, 7, 9 | API restriction, upgrades |
 | System Hardening | 4, 6, 11 | host footprint, external access; AppArmor needs a compatible kernel |
 | Microservice Vulnerabilities | 5, 6, 7, 8, 10 | multi-tenancy/sandboxes, Cilium encryption |
-| Supply Chain Security | 13, 27 | images, SBOM, signing, registries, image scanning |
+| Supply Chain Security | 13, 27, 30 | signing, registries, image scanning |
 | Monitoring/Logging/Runtime | 12 | behavior analysis, runtime immutability, audit investigation |
 
 ## Supplemental: Istio service-mesh security

lab/lesson-29-answer.yaml

@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: test-network-policy
+  namespace: storefront
+spec:
+  podSelector:
+    matchLabels:
+      app: frontend
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: payments-mesh
+      podSelector:
+        matchLabels:
+          app: payments-api
+    ports:
+    - protocol: TCP
+      port: 8080
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+    ports:
+    - port: 53
+      protocol: TCP
+    - port: 53
+      protocol: UDP
+

lab/lesson-30-answer.md

@@ -0,0 +1,27 @@
+docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json > .\lab\lesson-30-sbom.json
+
+nginx:1.27-alpine, CycloneDX json
+
+        {
+          "type": "application",
+          "author": "anchore",
+          "name": "syft",
+          "version": "1.50.0"
+        }
+              "bom-ref": "7cfd11f0aac064b9",
+      "type": "container",
+      "name": "nginx",
+      "version": "1.27-alpine"
+            "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=x86_64&distro=alpine-3.21.3&package-id=0df337d25a2602d5",
+     
+     
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "alpine-baselayout",
+      "version": "3.6.8-r1",
+      "description": "Alpine base dir structure and init scripts",
+
+
+      it inventories components but does not determine whether the image is free of vulnerabilities or safe to deploy
+
+      bom helps after new CVE by revealing if the packege is install insude the image and also if the vulnerable version is running

learning-records/0004-retrieval-profile-through-lesson-13.md

@@ -17,6 +17,8 @@
 - Completed focused RBAC remediation independently: narrowed an existing Role so its ServiceAccount retains ConfigMap read/watch access but cannot read Secrets or create ConfigMaps.
 - Completed the first supplemental Istio security drill independently: namespace-wide `PeerAuthentication` uses the current v1 API and strict mTLS without an unnecessary selector or port exception.
 - Completed supplemental Istio workload authorization after incremental review: an `ALLOW` policy selects only `payments-api`, grants only the exact `web-mesh/frontend` principal, and limits it to port `8080`.
+- Completed node-metadata egress isolation after one correction: a single frontend egress policy permits only the payments API on TCP 8080 and CoreDNS on TCP/UDP 53, leaving metadata and other internet access denied.
+- Completed SBOM generation and interpretation: produced a pinned-image CycloneDX JSON inventory with Syft and correctly distinguished component inventory from vulnerability or deployment-safety proof.
 
 ## Retrieval gaps to keep drilling
 

lessons/0030-generate-image-sbom.html

@@ -0,0 +1 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 30: Generate an image SBOM</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0030 · 25 minutes · Supply Chain Security</p><h1>Generate an SBOM before approving an image</h1><p class="lede">An SBOM is an inventory of software components in an artifact. It supports vulnerability response, license review, and incident investigation, but it does not by itself prove that an image is safe.</p><h2>Timed task: 15 minutes</h2><p>From the CKS workspace, generate a CycloneDX JSON SBOM for <code>nginx:1.27-alpine</code> and save it as <code>lab/lesson-30-sbom.json</code>.</p><pre><code>docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json &gt; .\lab\lesson-30-sbom.json</code></pre><p>Create <code>lab/lesson-30-answer.md</code> with:</p><ul><li>the exact command you ran;</li><li>the image reference and SBOM format;</li><li>three component names and versions from the generated SBOM; and</li><li>one sentence explaining why an SBOM helps after a new CVE, plus one sentence explaining what an SBOM alone does not establish.</li></ul><p>Do not use <code>latest</code>, alter the generated JSON, or claim that the SBOM is a vulnerability scan.</p><div class="callout"><strong>Exam reflex:</strong> pin tool and workload versions whenever possible. Repeatable evidence lets you compare what changed between releases.</div><h2>Useful PowerShell inspection</h2><pre><code>(Get-Content .\lab\lesson-30-sbom.json -Raw | ConvertFrom-Json).components | Select-Object name,version -First 10</code></pre><h2>Documentation target</h2><p>See the official <a href="https://github.com/anchore/syft">Syft documentation</a>; it supports container-image scanning and CycloneDX JSON output.</p><h2>What to send me</h2><p>Save both files, then say <em>check</em>. I’ll validate the evidence one item at a time.</p></main></body></html>