2 lines
2.9 KiB
HTML
2 lines
2.9 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 27: Static manifest analysis</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0027 · 25 minutes · Supply Chain Security</p><h1>Find and prioritize insecure workload configuration</h1><p class="lede">A static scan examines manifests before they reach the cluster. It is useful in CI because it catches risky workload settings early, but its findings still need human prioritization.</p><h2>Timed task: 15 minutes</h2><p>Scan <code>lab/lesson-27-fixture.yaml</code> with Trivy. Docker Desktop is sufficient; run:</p><pre><code>docker run --rm -v ${PWD}:/work aquasec/trivy:0.68.1 config /work/lab/lesson-27-fixture.yaml</code></pre><p>Create <code>lab/lesson-27-answer.md</code>. Do not modify the fixture.</p><p>Your answer must contain:</p><ul><li>the exact scan command you ran;</li><li>three distinct findings from the manifest, in priority order;</li><li>one short sentence for each explaining why it increases risk; and</li><li>one concrete remediation for each finding.</li></ul><div class="callout"><strong>Scope:</strong> report only manifest/configuration findings. Do not claim image-CVE results unless you also scanned an image. A tag such as <code>latest</code> is a deployment reproducibility and supply-chain issue, not proof of a CVE.</div><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Why should CI scan both manifests and images?</p><label><input type="radio" name="q" value="both">They reveal different risks: manifests expose configuration risk, while images can expose package vulnerabilities and insecure contents.</label><label><input type="radio" name="q" value="same">They always produce the same findings.</label><label><input type="radio" name="q" value="replace">A manifest scan replaces runtime monitoring.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official <a href="https://trivy.dev/latest/docs/target/config/">Trivy configuration scanning documentation</a>.</p><h2>What to send me</h2><p>Save the Markdown answer, then say <em>done check</em>. I’ll review one finding at a time and will not supply the whole answer unless you request it.</p><footer>CKS path: Supply Chain Security · Previous: <a href="0024-rbac-remediate-overprivileged-role.html">RBAC remediation</a></footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='both'){f.textContent='Correct. Configuration and image contents are separate attack surfaces.';f.className='feedback good';}else{f.textContent='Not quite. Each scan type finds risks the other cannot see.';f.className='feedback bad';}}</script></body></html>
|