Cheat notes · Runtime surfaces
Runtime surfaces: cheat notes
Every module on one page, cut to what you need to remember: the idea, the commands, the pitfalls and a few questions to test yourself. Made for review after you have done the course, not instead of it. Back to the course.
00 Re-enter the lab
This module only · Full module
The idea
Resume with the register and notebook from the pipeline course. The same register and repo continue; S01 to S06 remain evidenced and S07 is ready to test.
Remember
- Surface: surfaces:
- Trust: A retest date shows when the proof was last run.
- Evidence: An open row is a gap, not a failed course.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
surfaces:
What do you test?
Check the shared repository, kind cluster and course A evidence before changing runtime policy.
What evidence proves the fix?
The same register and repo continue; S01 to S06 remain evidenced and S07 is ready to test.
Where module 00 leaves you: The same register and repo continue; S01 to S06 remain evidenced and S07 is ready to test.
01 A pod in a box
This module only · Full module
The idea
Trace what a compromised process can reach inside its namespace. S07 records the measured pod, API and network limits.
Remember
- Surface: kind: NetworkPolicy
- Trust: A read-only root filesystem does not remove network credentials.
- Evidence: Test what the pod can reach, not just its manifest.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
kind: NetworkPolicy
What do you test?
Inspect the checkout security context and NetworkPolicy, test service-account access and egress, then prove the namespace boundary.
What evidence proves the fix?
S07 records the measured pod, API and network limits.
Where module 01 leaves you: S07 records the measured pod, API and network limits.
02 Cloud metadata and OIDC
This module only · Full module
The idea
Follow a request-forgery path to a mock metadata endpoint and test CI trust. S08 is covered and S08a records a dated public HTTPS exception.
Remember
- Surface: IMDSv2 requires a session token before metadata credentials are returned.
- Trust: A GitHub OIDC subject identifies the repository, event or environment.
- Evidence: The local mock returns sample values that open no cloud account.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
IMDSv2 requires a session token before metadata credentials are returned.
What do you test?
Use the local metadata mock and fake role credentials, close the path with an application host allowlist, IMDSv2 and network policy, then narrow OIDC trust to a production environment.
What evidence proves the fix?
S08 is covered and S08a records a dated public HTTPS exception.
Where module 02 leaves you: S08 is covered and S08a records a dated public HTTPS exception.
03 Incident response
This module only · Full module
The idea
Preserve evidence and contain a compromised dependency, workflow or image. Three incident records name the surface, timeline, containment and follow-up control.
Remember
- Surface: The lab incident is a controlled simulation with no exfiltration or real credential.
- Trust: A failed admission can be evidence that a boundary is working.
- Evidence: Rotate credentials after preserving the minimum useful run metadata.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
The lab incident is a controlled simulation with no exfiltration or real credential.
What do you test?
Work three seeded incident cases: moved action reference, unknown workflow and denied image. Disable the affected path, rotate the fake credential, capture evidence and update the register.
What evidence proves the fix?
Three incident records name the surface, timeline, containment and follow-up control.
Where module 03 leaves you: Three incident records name the surface, timeline, containment and follow-up control.
04 Capstone: team-catalog
This module only · Full module
The idea
Audit a second team hand-over and defend your path analysis. Team-catalog has a covered register, an attacker notebook and an evidence-backed hand-over.
Remember
- Surface: The capstone fixture contains decoys and controls that already work.
- Trust: Choose evidence that can falsify a hypothesis before editing controls.
- Evidence: A valid signature can still represent a build from untrusted input.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
The capstone fixture contains decoys and controls that already work.
What do you test?
Identify fourteen seeded gaps across seven surfaces, rank the cheapest path, test a harmless canary, close two independent boundaries and update both evidence files.
What evidence proves the fix?
Team-catalog has a covered register, an attacker notebook and an evidence-backed hand-over.
Where module 04 leaves you: Team-catalog has a covered register, an attacker notebook and an evidence-backed hand-over.