Lab & Completion

What You Will Produce

On your own kind cluster: the platform’s credential registry checked - and the same check failing for a credential past its date. What a person in each GitHub team may do, asked with impersonation, and an admin’s change to Flux refused. A token pasted into a file, stopped before the commit. A database password rotated - the new password works, the old one is refused - and the backend restarted through Git, after watching what Flux does to kubectl rollout restart - it may undo it, or the restart may finish first.

Before You Start

The baseline from Chapter 00 must be clean:

flux --context kind-sre-control-plane get kustomizations -A          # every row READY=True and SUSPENDED=False
kubectl --context kind-sre-control-plane get pods -A --no-headers | grep -vE 'Running|Completed'   # prints nothing
make smoke-test                     # 9/9

You need yq, gh (signed in) and openssl, and the pre-commit hooks installed in your clone (make install-hooks, Chapter 05). The first gitleaks run builds its hook - pre-commit downloads Go for it if you have none, a few minutes on a slow network. Your fork must be up to date: if docs/credential-registry.yaml does not exist in your clone, open your fork on GitHub, click Sync fork → Update branch, then git switch main && git pull.

The Lab in Three Parts

  • A. Verify - the registry and its check; who may do what.
  • B. Break & Fix - a credential past its date; a token pasted into a file; an admin’s change to Flux refused; a database password rotated, proven both ways, and the readers restarted through Git.
  • C. Rollback & Cleanup - no lab branches, the baseline.

Open the lab →

Done When

  • the registry check passed, and you can say for one credential what it opens, where its copies live and when it is due (A2)
  • you can say what safeops-course:members may do in develop and in production, from auth can-i (A3)
  • your predictions were written before B2 (B1)
  • the check failed for a credential past its date, and the branch was thrown away (B2)
  • gitleaks stopped the commit of a pasted token that the file-name check would have let through (B3)
  • the policy refused an admin’s change to a Kustomization, and allowed suspend (B4)
  • the new database password worked and the old one was refused (B5)
  • you saw what Flux did to kubectl rollout restart - the annotation gone, the pod the same or new by timing - and restarted the backend through Git - then a new user registered and signed in through it (B6)
  • no lab branch is left and the baseline is clean (C1-C2)