Skip to content
CKSMinimize Microservice VulnerabilitiesSingle nodeMedium

Secrets: from environment variables to a read-only volume

Scenario cks-mic-003 · about 8 minutes · 9 points · 7 grader checks

Move a Secret from an environment variable to a read-only volume with restrictive file mode and make the Secret immutable.

  • secrets
  • immutable
  • volumes
  • deployment
  • least-privilege

What you will practise

  • Make a Secret immutable
  • Mount a Secret as a read-only volume with defaultMode
  • Remove secretKeyRef environment variables from a running Deployment

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-mic-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In namespace "secret-app" the Deployment "api" (container "api") reads the Secret "api-key" through the environment variable API_TOKEN. Environment variables leak into crash dumps, logs and child processes. 1. Make the Secret "api-key" immutable. Its data must not change. 2. Edit the Deployment "api" (do not recreate it): remove every environment variable that comes from a Secret and instead mount the Secret "api-key" as a read-only volume at /etc/api-key, with file mode 0400. The application then reads /etc/api-key/token. The Deployment's replica must be Ready with the new pod template.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Minimize Microservice Vulnerabilities
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
9
Grader checks
7
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 7 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Minimize Microservice Vulnerabilities labs

CKSMinimize Microservice VulnerabilitiesMedium

Pod Security Admission: enforce restricted

Enforce the restricted Pod Security Standard on a namespace and bring a non-compliant Deployment into line without recreating it.

Single node · ~9 min · 9 points

  • pod-security-admission
  • pod-security-standards
  • restricted
  • securitycontext
  • seccomp

goldenkube start cks-mic-001

CKSMinimize Microservice VulnerabilitiesHard

Encrypt Secrets at rest in etcd

Write an EncryptionConfiguration, wire it into the API server static pod and rewrite an existing Secret so etcd holds it encrypted.

Single node · ~10 min · 8 points

  • secrets
  • encryption-at-rest
  • etcd
  • kube-apiserver
  • static-pod

goldenkube start cks-mic-002

CKSMinimize Microservice VulnerabilitiesMedium

Isolation: remove host namespaces and privileged mode

A tenant workload shares the node's network, PID and IPC namespaces, runs privileged and mounts the host; isolate it and enforce baseline.

Single node · ~8 min · 9 points

  • isolation
  • multi-tenancy
  • host-namespaces
  • privileged
  • pod-security-admission

goldenkube start cks-mic-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.