Skip to content
CNPESecurity and Policy EnforcementSingle nodeHard

Supply chain: Trivy SBOM and a Gatekeeper registry allow-list

Scenario cnpe-sec-003 · about 18 minutes · 10 points · 8 grader checks

Produce a CycloneDX SBOM for an image from the node's containerd store with Trivy and publish it as a ConfigMap, then restrict the registries Pods in a namespace may pull from with an OPA Gatekeeper ConstraintTemplate and Constraint.

  • supply-chain
  • sbom
  • cyclonedx
  • trivy
  • gatekeeper
  • opa
  • rego
  • security

What you will practise

  • Generate a CycloneDX SBOM for a container image with Trivy
  • Write a Gatekeeper ConstraintTemplate in Rego with parameters
  • Scope a Constraint to one namespace and verify it with dry-run

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cnpe-sec-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

OPA Gatekeeper is installed. The image docker.io/curlimages/curl:8.17.0 is present in the containerd image store of exam-cp1. 1. On exam-cp1 generate a CycloneDX SBOM (JSON) of docker.io/curlimages/curl:8.17.0 with trivy, reading the image from containerd (not from a registry). Store it in namespace "supply" as the ConfigMap "sbom-curl" with the key "bom.json". 2. Create the Gatekeeper ConstraintTemplate "k8sallowedregistries" (Constraint kind K8sAllowedRegistries) with a parameter "registries" (list of image prefixes) that rejects Pods with any container image not starting with one of the prefixes. 3. Create the Constraint "allowed-registries" of that kind for Pods in namespace "supply" only, allowing the prefixes "registry.k8s.io/" and "ghcr.io/stefanprodan/".

Requirements and details

Certification
CNPE · Certified Cloud Native Platform Engineer
Domain
Security and Policy Enforcement
Difficulty
Hard
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
18 minutes
Points
10
Grader checks
8
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Security and Policy Enforcement labs

CNPESecurity and Policy EnforcementHard

Service mesh: enforce strict mTLS for a namespace with Istio

Move the bank and frontend workloads into the Istio mesh and require mutual TLS for every workload in bank, so meshed clients still reach the ledger while plaintext clients are refused.

Single node · ~16 min · 11 points

  • istio
  • service-mesh
  • mtls
  • peerauthentication
  • zero-trust
  • security

goldenkube start cnpe-sec-001

CNPESecurity and Policy EnforcementMedium

Guardrails: least-privilege RBAC for a CI identity and a Kyverno pod baseline

Give the CI service account exactly the rights it needs to roll out Deployments in one namespace, and enforce a pod baseline there with Kyverno: non-root containers and pinned image tags.

Single node · ~16 min · 11 points

  • rbac
  • kyverno
  • policy-as-code
  • admission-control
  • least-privilege
  • security

goldenkube start cnpe-sec-002

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.