Workload & Supply Chain · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Pod Security Admission (namespace labels)
kubectl label ns shop pod-security.kubernetes.io/enforce=restricted | Reject non-compliant pods |
kubectl label ns shop pod-security.kubernetes.io/warn=restricted | Warn clients but allow |
kubectl label ns shop pod-security.kubernetes.io/audit=restricted | Record violations in the audit log |
kubectl label --dry-run=server --overwrite ns shop pod-security.kubernetes.io/enforce=restricted | Preview which existing pods would violate |
Custom policy
kubectl get validatingadmissionpolicies | Built-in CEL policies |
kubectl get clusterpolicies | Kyverno policies |
kubectl get constrainttemplates,constraints | Gatekeeper policies |
Encryption at rest
--encryption-provider-config=/etc/kubernetes/enc/enc.yaml | kube-apiserver flag pointing at the EncryptionConfiguration |
etcdctl … get /registry/secrets/<ns>/<name> | hexdump -C | head | Check the raw value is encrypted (k8s:enc:… prefix) |
kubectl get secrets -A -o json | kubectl replace -f - | Rewrite all Secrets so they're re-encrypted with the current key |
Getting secrets into the cluster
kubectl get externalsecrets -A | External Secrets Operator: sync status |
kubeseal --format yaml < secret.yaml > sealed.yaml | Sealed Secrets: encrypt for Git |
vault kv get secret/shop/db | Read a secret from Vault (CLI) |
Inspect images
syft registry.example.com/shop/api:1.4.2 -o spdx-json > sbom.json | Generate an SBOM |
trivy image --severity HIGH,CRITICAL registry.example.com/shop/api:1.4.2 | Scan for known vulnerabilities |
trivy sbom sbom.json | Scan an existing SBOM |
crane digest registry.example.com/shop/api:1.4.2 | The immutable digest behind a tag |
Sign & verify (cosign)
cosign generate-key-pair | Create cosign.key / cosign.pub (or use keyless signing) |
cosign sign --key cosign.key <image>@sha256:<digest> | Sign an image by digest |
cosign verify --key cosign.pub <image>@sha256:<digest> | Verify the signature |
cosign attest --key cosign.key --type spdxjson --predicate sbom.json <image>@sha256:<digest> | Attach a signed SBOM attestation |
