2 lines
4.4 KiB
HTML
2 lines
4.4 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 10: Minimize Secret exposure</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0010 · 35 minutes · Minimize Microservice Vulnerabilities</p><h1>Expose only the Secret data an application needs</h1><p class="lede">Mounting a Secret is not automatically least privilege: every key becomes readable to the process. This drill combines a single-key Secret projection with the workload controls you should now retrieve from memory.</p><div class="callout"><strong>Exam reflex:</strong> secure the data path, not just the Secret object. Limit which keys are projected, where they appear, who can read them, and whether the Pod receives unrelated API credentials.</div><h2>Timed task: 25 minutes</h2><p>Apply <code>lab/lesson-10-fixture.yaml</code>. In namespace <code>billing</code>, create <code>lab/lesson-10-answer.yaml</code> from scratch containing a Pod named <code>reconciler</code>.</p><p>The Pod must use image <code>busybox:1.37</code> with command <code>sh -c 'sleep 3600'</code>, run as UID <code>1000</code>, and satisfy all requirements below:</p><ul><li>Mount only the <code>api-key</code> key from Secret <code>billing-credentials</code>.</li><li>Expose it as the file <code>/var/run/credentials/api-key</code>; the Secret’s <code>legacy-password</code> must not be present in the container.</li><li>Make the projected Secret volume read-only for the container.</li><li>Do not mount a ServiceAccount token.</li><li>Use <code>RuntimeDefault</code> seccomp, prevent privilege escalation, and drop all Linux capabilities.</li><li>Use a read-only root filesystem while still allowing the process to use <code>/tmp</code>.</li></ul><p>Do not use environment variables for the Secret and do not use wildcard-like broad mounts of the Secret volume.</p><h2>Verification</h2><pre><code>kubectl --context kind-cks-lab apply -f .\lab\lesson-10-fixture.yaml kubectl --context kind-cks-lab apply -f .\lab\lesson-10-answer.yaml kubectl --context kind-cks-lab -n billing wait --for=condition=Ready pod/reconciler --timeout=60s kubectl --context kind-cks-lab -n billing exec reconciler -- id kubectl --context kind-cks-lab -n billing exec reconciler -- cat /var/run/credentials/api-key kubectl --context kind-cks-lab -n billing exec reconciler -- sh -c 'test ! -e /var/run/credentials/legacy-password && touch /tmp/proof' kubectl --context kind-cks-lab -n billing exec reconciler -- sh -c 'test ! -e /var/run/secrets/kubernetes.io/serviceaccount/token'</code></pre><p>Expected: a non-zero UID, <code>test-key</code>, and success from each final two commands.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Which Secret-volume mechanism prevents an unneeded key from being mounted at all?</p><label><input type="radio" name="q" value="items">Specify the allowed key under the volume’s <code>items</code> list.</label><label><input type="radio" name="q" value="readonly">Set only <code>readOnly: true</code> on the volume mount.</label><label><input type="radio" name="q" value="mode">Set a restrictive file mode alone.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the Kubernetes <a href="https://kubernetes.io/docs/concepts/configuration/secret/">Secret</a> reference for selective key projection and the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Security Context</a> guide for the runtime controls.</p><h2>What to send me</h2><p>Paste your Pod YAML and the four proof results. I’ll inspect both the visible behavior and whether the manifest prevents the broader Secret exposure.</p><footer>Previous: <a href="0009-rbac-subresources-and-resourcenames.html">Precise RBAC</a> · CKS domain: Minimize Microservice Vulnerabilities</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='items'){f.textContent='Correct. items controls which Secret keys are projected into the volume.';f.className='feedback good';}else{f.textContent='Not quite. Read-only and file mode help protect mounted data, but items limits which keys appear at all.';f.className='feedback bad';}}</script></body></html>
|