Skip to content
CKSSupply Chain SecuritySingle nodeEasy

Verify platform binaries before deploying

Scenario cks-sup-004 · about 6 minutes · 6 points · 2 grader checks

Check downloaded Kubernetes binaries against published SHA-512 checksums and discard the tampered ones.

  • checksums
  • sha512
  • binaries
  • supply-chain
  • upgrade

What you will practise

  • Verify files with sha512sum against a published list
  • Recognise a tampered artifact
  • Keep only verified artifacts

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-sup-004

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

A mirror delivered Kubernetes binaries for the next upgrade to /opt/release on exam-cp1: kubeadm, kubectl and kubelet. The release team published the official SHA-512 checksums in the ConfigMap "release-checksums" (key SHA512SUMS) in namespace "release". Verify every binary in /opt/release against the published checksums and delete each file whose checksum does not match. Keep the files that match, unmodified. Do not change the ConfigMap.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Supply Chain Security
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
6 minutes
Points
6
Grader checks
2
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 2 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Supply Chain Security labs

CKSSupply Chain SecurityHard

Permitted registries with ValidatingAdmissionPolicy

Allow only images from one registry in labelled namespaces using a CEL ValidatingAdmissionPolicy and its binding.

Single node · ~9 min · 9 points

  • validatingadmissionpolicy
  • cel
  • admission
  • image-registry
  • supply-chain

goldenkube start cks-sup-001

CKSSupply Chain SecurityEasy

Static analysis of workload manifests

Review six Deployment manifests against four security rules, report the violators and deploy only the compliant ones.

Single node · ~8 min · 7 points

  • static-analysis
  • manifests
  • supply-chain
  • securitycontext
  • review

goldenkube start cks-sup-002

CKSSupply Chain SecurityEasy

Pin a workload image by digest

Replace a mutable image tag with the digest of the image the running pods already use.

Single node · ~6 min · 7 points

  • image-digest
  • supply-chain
  • immutability
  • deployment
  • containerd

goldenkube start cks-sup-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.