CKS-Lessons/lab/lesson-32-answer.md

1. The failed request was an attempt by system:serviceaccount:default:unknown to create ClusterRoleBinding unknown-admin. Response code 403 and status Failure prove that the API server rejected the request.

2. the requested principle came from system:serviceaccount:checkout:release-bot

3. first successful escalation event is audit ID: b3, timestamp: 2026-08-25T04:22:11Z, verb: create, resourcetype: rolebindings, namespace: checkout, resourceName: release-bot-secret-reader

4. Secret checkout/payment-gateway was accessed successfully with a get request that returned HTTP 200.

5. The principal opened a pods/exec session in Pod checkout/checkout-api-6d8f; HTTP 101 shows the connection was upgraded.

6. First, delete RoleBinding checkout/release-bot-secret-reader to revoke the escalated Secret access.

Second, isolate or stop the workload using ServiceAccount checkout/release-bot, and terminate its access to Pod checkout/checkout-api-6d8f.

Third, rotate the credential stored in Secret checkout/payment-gateway, update its authorized consumers, and invalidate the old credential.