ced4568andClaude Sonnet 5
60fbf0c385
Pre-Phase-1 platform work, approved and tested earlier but not yet committed: - Terminal banner: "RootNode Academy Lab — node: k8s-lab", upstream KubeKosh attribution left untouched in footer/README/LICENSE. - RootNode curriculum mode: scenarios/rootnode-path.json (Foundation -> Workloads -> Networking -> Configuration -> Troubleshooting -> Real Ops -> Capstone), built from existing scenario content grouped by category, no new scenarios invented. New GET /api/curriculum/path endpoint. - Student roster + per-student progress: instructor-roster, pick-your-name login (no password), students/environments-adjacent progress table migrated to a (student_id, scenario_id) composite key so practice progress and exam sessions are isolated per student instead of one global bucket. New /api/roster, /api/login endpoints. - scenarios/data/*.json: added isolation_type metadata (shared_namespace vs ephemeral_cluster) from an audit of which scenarios execute cluster-scoped or node-level commands. This was Tier-1-isolation groundwork that got superseded same-day by the full-ephemeral-per-student architecture (see docs/LAB_ARCHITECTURE.md) — the field is kept as descriptive metadata only, per the note now in scenarios/SCHEMA.md. Not wasted: it's an accurate audit of which scenarios touch cluster-scoped resources, useful independent of isolation model. - .gitignore added (node_modules/, frontend/dist/, *.db, /data/, .env) — none existed before; without it, npm installs during testing would have landed in a commit. Known limitation still open: no frontend UI for any of this yet (login screen, roster-add form, curriculum view) — API-only. No auth on the roster-add endpoint. Co-Authored-By: Claude Sonnet 5 <[email protected]>
63 lines
3.7 KiB
JSON
63 lines
3.7 KiB
JSON
{
|
|
"id": "cks-audit-policy",
|
|
"title": "Write a Kubernetes Audit Policy",
|
|
"category": "Cluster Setup",
|
|
"isolation_type": "ephemeral_cluster",
|
|
"difficulty": "Hard",
|
|
"type": "task",
|
|
"weight": 7,
|
|
"description": "## Kubernetes Audit Policy\n\nAudit logging lets you track who did what on the cluster. The kube-apiserver reads an **audit policy file** to decide which events to log and at which verbosity level.\n\n**Your task:**\n\nWrite an audit policy file at `/etc/kubernetes/audit-policy.yaml` with the following rules (in order):\n\n1. Log all operations on `secrets` in any namespace at level **`RequestResponse`**.\n2. Log read operations (`get`, `list`, `watch`) on `pods` at level **`Metadata`**.\n3. **Drop** (level `None`) all events for the `system:masters` group.\n4. Log everything else at level **`Metadata`** as a catch-all.\n\n```bash\n# Verify the policy file exists and contains the key fields:\ncat /etc/kubernetes/audit-policy.yaml\n```",
|
|
"hints": [
|
|
{
|
|
"title": "Audit policy structure",
|
|
"body": "An audit policy is a YAML file with `apiVersion: audit.k8s.io/v1`, `kind: Policy`, and a `rules:` list. Order matters — first matching rule wins.",
|
|
"command": "cat <<EOF > /etc/kubernetes/audit-policy.yaml\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n- level: RequestResponse\n resources:\n - group: \"\"\n resources: [\"secrets\"]\n- level: Metadata\n verbs: [\"get\", \"list\", \"watch\"]\n resources:\n - group: \"\"\n resources: [\"pods\"]\n- level: None\n userGroups: [\"system:masters\"]\n- level: Metadata\nEOF"
|
|
}
|
|
],
|
|
"setup_commands": [
|
|
{
|
|
"command": "mkdir -p /etc/kubernetes"
|
|
}
|
|
],
|
|
"validation": {
|
|
"commands": [
|
|
{
|
|
"description": "Audit policy file is valid YAML with kind: Policy",
|
|
"command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print(p.get('kind',''))\"",
|
|
"expected_output": "Policy",
|
|
"match": "exact"
|
|
},
|
|
{
|
|
"description": "Rule 1: level is RequestResponse and targets secrets",
|
|
"command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); r=p['rules'][0]; print('ok' if r['level']=='RequestResponse' and any('secrets' in x.get('resources',[]) for x in r.get('resources',[])) else 'fail')\"",
|
|
"expected_output": "ok",
|
|
"match": "exact"
|
|
},
|
|
{
|
|
"description": "Rule 2: level is Metadata, targets pods, verbs include get/list/watch",
|
|
"command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print('ok' if any(r.get('level')=='Metadata' and any('pods' in x.get('resources',[]) for x in r.get('resources',[])) and set(r.get('verbs',[])) >= {'get','list','watch'} for r in p['rules']) else 'fail')\"",
|
|
"expected_output": "ok",
|
|
"match": "exact"
|
|
},
|
|
{
|
|
"description": "Rule 3: level is None for system:masters group",
|
|
"command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print('ok' if any(r.get('level')=='None' and 'system:masters' in r.get('userGroups',[]) for r in p['rules']) else 'fail')\"",
|
|
"expected_output": "ok",
|
|
"match": "exact"
|
|
},
|
|
{
|
|
"description": "Rule 4: catch-all is level Metadata with no other selectors",
|
|
"command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); last=p['rules'][-1]; print('ok' if set(last.keys())=={'level'} and last['level']=='Metadata' else 'fail')\"",
|
|
"expected_output": "ok",
|
|
"match": "exact"
|
|
}
|
|
]
|
|
},
|
|
"default_namespace": "default",
|
|
"teardown_commands": [
|
|
{
|
|
"command": "rm -f /etc/kubernetes/audit-policy.yaml"
|
|
}
|
|
]
|
|
}
|