Lab & Completion

What You Will Produce

On your own kind cluster, proof of the platform’s hardening on the running pods: the backend runs as UID 10001, its root filesystem refuses a write with Read-only file system, its /tmp accepts one, and it has no service account token. Pod Security refuses an unhardened pod in develop and only warns in lab. Then, in lab: a one-shot pod that fails on a write nobody declared, the same pod fixed with one size-limited emptyDir and nothing else weakened, and a Permission denied that has a different cause - and is not fixed with root. The lab ends with lab empty; the apps in develop are never changed.

Before You Start

The baseline from Chapter 00 must be clean:

flux --context kind-sre-control-plane get kustomizations -A          # every row READY=True and SUSPENDED=False
kubectl --context kind-sre-control-plane get pods -A --no-headers | grep -vE 'Running|Completed'   # prints nothing
make smoke-test                     # 9/9

This chapter also needs labs/security-context/ in your clone: if it is missing, your fork must first catch up with the course repository: on GitHub, open your fork and click Sync fork → Update branch. Then git switch main && git pull - it fetches from your clone’s remote (your fork) and merges the changes into your local main; it does not sync your fork with the course repository, which is why the Sync fork step comes first.

The Lab in Three Parts

  • A. Verify - the backend’s user, contexts and token; a refused and an accepted write inside it; Pod Security in develop and in lab.
  • B. Break & Fix - Read-only file system on an undeclared path; the fix with a size-limited emptyDir; Permission denied as a different error.
  • C. Rollback & Cleanup - the lab’s pods deleted, lab empty, the baseline proven.

Open the lab →

Done When

  • the backend printed uid=10001, its container context "readOnlyRootFilesystem":true, "allowPrivilegeEscalation":false, "drop":["ALL"], and automountServiceAccountToken false (A2)
  • inside the backend, the write to /etc failed with Read-only file system and exit=1, the write to /tmp printed ok, and the token path did not exist (A3)
  • 00-insecure.yaml was Forbidden in develop and accepted with a Warning: would violate PodSecurity in lab (A4)
  • 10-writer-readonly.yaml logged Read-only file system (B1)
  • 20-writer-emptydir.yaml logged written, /etc: read-only, uid: 65532 and token: none (B2)
  • 30-writer-permission.yaml logged Permission denied (B3)
  • at the end kubectl --context kind-sre-control-plane -n lab get pods prints No resources found and the baseline is clean (C1-C2)

Knowledge Check

Before finishing this chapter, complete the Quiz.