2 lines
4.5 KiB
HTML
2 lines
4.5 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 13: Image digest admission</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0013 · 45 minutes · Supply Chain Security</p><h1>Enforce immutable container images at admission</h1><p class="lede">A tag can be moved after review; a digest identifies immutable content. This drill combines workload remediation with a native admission control that blocks the next mutable image.</p><div class="callout"><strong>Exam reflex:</strong> distinguish detecting an unsafe image from preventing its reintroduction. First remediate the workload; then enforce the intended rule at the narrowest practical scope.</div><h2>Timed task: 35 minutes</h2><p>Apply <code>lab/lesson-13-fixture.yaml</code>. Create <code>lab/lesson-13-answer.yaml</code> from scratch. Do not alter the fixture.</p><p>Your answer must contain all resources needed to meet these requirements:</p><ul><li>Update Deployment <code>frontend</code> so its container image is an immutable digest reference from the official Docker Hub library. Preserve its name, namespace, replica count, labels, container name, and command.</li><li>Create a native <code>ValidatingAdmissionPolicy</code> and <code>ValidatingAdmissionPolicyBinding</code>.</li><li>Within only the <code>supply-chain</code> namespace, reject Pod creates and updates unless every regular container image starts with <code>docker.io/library/</code> and contains an image digest (<code>@sha256:</code>).</li><li>The policy must deny invalid workloads with a helpful message. Do not use a webhook, Kyverno, or a cluster-wide binding.</li></ul><p>Retrieve the digest from the running fixture Pod rather than guessing it: inspect <code>.status.containerStatuses[0].imageID</code>. The admission expression must validate all containers, not merely the first one.</p><h2>Verification</h2><pre><code>kubectl --context kind-cks-lab apply -f .\lab\lesson-13-fixture.yaml kubectl --context kind-cks-lab -n supply-chain get pod -l app=frontend -o jsonpath='{.items[0].status.containerStatuses[0].imageID}{"\n"}' kubectl --context kind-cks-lab apply -f .\lab\lesson-13-answer.yaml kubectl --context kind-cks-lab -n supply-chain rollout status deployment/frontend --timeout=90s kubectl --context kind-cks-lab -n supply-chain run mutable-test --image=busybox:1.37 --restart=Never kubectl --context kind-cks-lab -n default run outside-scope --image=busybox:1.37 --restart=Never</code></pre><p>Expected: the rollout succeeds; <code>mutable-test</code> is rejected by admission; <code>outside-scope</code> is admitted because the binding is limited to <code>supply-chain</code>. Remove <code>outside-scope</code> after testing.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Why is <code>busybox:1.37</code> weaker supply-chain evidence than <code>docker.io/library/busybox@sha256:…</code>?</p><label><input type="radio" name="q" value="digest">A tag can be repointed, while a digest identifies immutable image content.</label><label><input type="radio" name="q" value="size">A digest always makes an image smaller.</label><label><input type="radio" name="q" value="network">A digest removes the need for registry access.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the Kubernetes <a href="https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/">Validating Admission Policy</a> reference and inspect the schema locally with <code>kubectl explain validatingadmissionpolicy.spec.validations</code>.</p><h2>What to send me</h2><p>Paste your policy, binding, and Deployment update, followed by the two admission outcomes. I’ll evaluate the CEL logic, namespace scope, and image-reference enforcement.</p><footer>Previous: <a href="0012-audit-log-investigation.html">Audit log investigation</a> · CKS domain: Supply Chain Security</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='digest'){f.textContent='Correct. Tags are mutable references; digests identify a specific immutable manifest.';f.className='feedback good';}else{f.textContent='Not quite. The key difference is immutability and traceability, not image size or network access.';f.className='feedback bad';}}</script></body></html>
|