Skip to content
CKSSupply Chain SecuritySingle nodeHard

Permitted registries with ValidatingAdmissionPolicy

Scenario cks-sup-001 · about 9 minutes · 9 points · 8 grader checks

Allow only images from one registry in labelled namespaces using a CEL ValidatingAdmissionPolicy and its binding.

  • validatingadmissionpolicy
  • cel
  • admission
  • image-registry
  • supply-chain

What you will practise

  • Write a ValidatingAdmissionPolicy with a CEL validation
  • Bind a policy to namespaces with a namespaceSelector
  • Cover init containers as well as containers

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-sup-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Only images from the registry "registry.k8s.io" may run in namespaces labelled image-policy=strict. Implement this with a ValidatingAdmissionPolicy (no webhook, no third-party tool): 1. ValidatingAdmissionPolicy "allowed-registries": applies to Pod CREATE and UPDATE, fails closed, and denies a Pod when any container or init container image does not start with "registry.k8s.io/". 2. ValidatingAdmissionPolicyBinding "allowed-registries-binding": binds the policy with the validation action Deny to namespaces that carry the label image-policy=strict. 3. Label the namespace "registry-guard" with image-policy=strict. The namespace "registry-free" must stay unrestricted.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Supply Chain Security
Difficulty
Hard
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
9
Grader checks
8
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Supply Chain Security labs

CKSSupply Chain SecurityEasy

Static analysis of workload manifests

Review six Deployment manifests against four security rules, report the violators and deploy only the compliant ones.

Single node · ~8 min · 7 points

  • static-analysis
  • manifests
  • supply-chain
  • securitycontext
  • review

goldenkube start cks-sup-002

CKSSupply Chain SecurityEasy

Pin a workload image by digest

Replace a mutable image tag with the digest of the image the running pods already use.

Single node · ~6 min · 7 points

  • image-digest
  • supply-chain
  • immutability
  • deployment
  • containerd

goldenkube start cks-sup-003

CKSSupply Chain SecurityEasy

Verify platform binaries before deploying

Check downloaded Kubernetes binaries against published SHA-512 checksums and discard the tampered ones.

Single node · ~6 min · 6 points

  • checksums
  • sha512
  • binaries
  • supply-chain
  • upgrade

goldenkube start cks-sup-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.