CKS_FINALE

learning-records/0001-networkpolicy-progress.md

@@ -0,0 +1,3 @@
+# NetworkPolicy topic accepted by learner
+
+The learner produced a functionally correct policy set after guided remediation, then chose to move to CIS benchmark review instead of completing the fresh first-attempt transfer gate. Treat NetworkPolicy as covered by learner request, but interleave it into later exercises because first-attempt mastery was not demonstrated.

learning-records/0002-cis-benchmark-progress.md

@@ -0,0 +1,3 @@
+# CIS benchmark topic accepted by learner
+
+The learner successfully remediated kube-apiserver and kubelet CIS findings after guided corrections, including backup placement, service recovery, host context, targeted reruns, and socket verification. The learner chose to move on before a clean first-attempt transfer, so interleave CIS remediation later.

learning-records/0003-ingress-tls-confidence.md

@@ -0,0 +1,3 @@
+# Ingress and TLS confidence established
+
+The learner produced a correct TLS Secret command and final TLS-enabled Ingress, and reports strong confidence with Ingress/TLS. Certificate inspection and Secret verification were omitted in the submitted workflow; NGINX annotation recall is the learner's stated weak point and should be interleaved later.

learning-records/0004-metadata-protection-mastered.md

@@ -0,0 +1,3 @@
+# Metadata endpoint protection mastered
+
+The learner independently produced a correct egress-isolating NetworkPolicy that retained HTTPS access while excluding the link-local cloud metadata endpoint. CKS-012 scored 100/100 on the first attempt, providing clean transfer evidence.

learning-records/0005-binary-verification-mastered.md

@@ -0,0 +1,3 @@
+# Platform binary verification mastered
+
+The learner correctly distinguished raw checksum files from standard checksum records, verified SHA-256/SHA-512 data, installed binaries with explicit ownership/mode, and independently completed CKS-015 on the first attempt.

learning-records/0006-rbac-prior-knowledge.md

@@ -0,0 +1,3 @@
+# RBAC confidence reported
+
+The learner reports being comfortable with Kubernetes RBAC and requested advancement without attempting CKS-016. Treat RBAC as covered but not independently demonstrated in this workspace; interleave least-privilege and subresource checks later.

learning-records/0007-service-account-assisted.md

@@ -0,0 +1,3 @@
+# Service-account token safety completed with assistance
+
+The learner reviewed a correct dedicated ServiceAccount and CronJob configuration with token automounting disabled at both levels. The final manifests were applied from a combined file; verification was explicitly skipped, so schedule a later interleaved check of projected token absence.