Cheat notes · Module 01 · Runtime and cloud
A pod in a box
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Trace what a compromised process can reach inside its namespace. S07 records the measured pod, API and network limits.
Remember
- Surface: kind: NetworkPolicy
- Trust: A read-only root filesystem does not remove network credentials.
- Evidence: Test what the pod can reach, not just its manifest.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
kind: NetworkPolicy
What do you test?
Inspect the checkout security context and NetworkPolicy, test service-account access and egress, then prove the namespace boundary.
What evidence proves the fix?
S07 records the measured pod, API and network limits.
Where module 01 leaves you: S07 records the measured pod, API and network limits.