Pass the Security Linter

medium 20 XP ~10 minHands-on lab

The deployment pipeline now lints every manifest with kube-linter, using the platform's profile in ~/.kube-linter.yaml. Your team's manifest ~/fraud-check.yaml fails it badly.

Task

kube-linter lint --config ~/.kube-linter.yaml ~/fraud-check.yaml reports no findings.
Keep the app what it is: nginxinc/nginx-unprivileged, but pinned to a version (1.27-alpine is in the registry). Its API_TOKEN comes from the existing Secret fraud-check-api (key token) instead of being written in the manifest.
Deploy the fixed file. 2 replicas run, and the cluster matches the file exactly.

Read the linter's output: each finding names its check and says how to fix it.

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

cks static-analysis kube-linter securitycontext supply-chain