Practice · Build · Verify
Reproducible DevOps and DevSecOps exercises with prerequisites, real commands, verification and cleanup.
Start here
Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.
Objective, prerequisites and architecture first.
Open the temporary browser workspace, when a lab offers one.
Run the commands and compare the expected output.
Follow the cleanup section, or discard the environment.
Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.
Seed a repository with realistic fake secrets, catch them with Gitleaks in history and working-tree modes, ignore a confirmed false positive by fingerprint, and block the next one at commit time.
Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.
Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.
On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.