Chapter 3 — Cloud and container security: specialist evidence
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Evidence needed"]
N2["Lab — enforcement coverage"]
N3["3.2 Lab result"]
N4["3.3 Interpreting"]
N5["3.4 Evidence quality"]
N6["3.5 Communicating"]
N7["Behaviour tests"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Evidence needed"]
N2["Lab — enforcement coverage"]
N3["3.2 Lab result"]
N4["3.3 Interpreting"]
N5["3.4 Evidence quality"]
N6["3.5 Communicating"]
N7["Behaviour tests"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Evidence needed]
|
v
[Lab — enforcement coverage]
|
v
[3.2 Lab result]
|
v
[3.3 Interpreting]
|
v
[3.4 Evidence quality]
|
v
[3.5 Communicating]
|
v
[Behaviour tests]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) gather specialist evidence about workload security across clusters; (2) measure enforcement coverage; (3) interpret gaps; (4) communicate evidence to decision makers.
3.1 Evidence needed
To plan the fix, Inês needs to know exactly which namespaces enforce which profile in each cluster. The audit gave a summary; she needs the detail. The summary gave a single figure for the estate, which could hide a cluster with no enforcement at all. The fix has to be applied namespace by namespace, so Inês needs to know each namespace's label and whether it actually enforces a profile. She collects this from the clusters directly rather than from documentation, since the audit showed that documentation and reality had drifted apart.
Lab — enforcement coverage
"""Pod security enforcement coverage per synthetic cluster after the upgrade (stdlib only)."""
clusters = { # cluster: list of (namespace, enforce level or None)
"claims-prod": [("claims", "restricted"), ("docs", "restricted"), ("batch", None)],
"quotes-prod": [("quotes", None), ("pricing", None)],
"shared-prod": [("monitoring", "privileged"), ("ingress", "baseline"), ("web", "restricted"), ("api", None)],
"analytics": [("etl", None), ("notebooks", None)],
}
tot = enf = 0
for c, ns in clusters.items():
e = sum(1 for _, lvl in ns if lvl in ("baseline", "restricted"))
tot += len(ns); enf += e
print(f"{c:12} {e}/{len(ns)} namespaces enforce baseline or restricted; unenforced: {', '.join(n for n, l in ns if l is None) or 'none'}")
print(f"estate {enf}/{tot} = {100*enf/tot:.0f}%")
Run with python3 lab_evidence.py. Verified output:
claims-prod 2/3 namespaces enforce baseline or restricted; unenforced: batch
quotes-prod 0/2 namespaces enforce baseline or restricted; unenforced: quotes, pricing
shared-prod 2/4 namespaces enforce baseline or restricted; unenforced: api
analytics 0/2 namespaces enforce baseline or restricted; unenforced: etl, notebooks
estate 4/11 = 36%
3.2 Lab result
claims-prod enforces on 2 of 3 namespaces (batch unenforced). quotes-prod enforces on 0 of 2 (quotes and pricing). shared-prod enforces on 2 of 4 (ingress at Baseline, web at Restricted; monitoring is labelled Privileged, which enforces nothing; api unenforced). analytics enforces on 0 of 2. Across the estate, 4 of 11 namespaces enforce Baseline or Restricted, 36%. The overall figure hides large differences between clusters: two clusters enforce nothing at all, while claims-prod enforces on most of its namespaces. Inês notes that monitoring counts as labelled but not enforcing, so a label check alone would have overstated coverage at shared-prod.
3.3 Interpreting
Unenforced namespaces include pricing and quotes, which handle customer data. monitoring's Privileged label is deliberate for its node agents but should be confined to that namespace. Pricing and quotes face the internet and process customer data, so their missing enforcement matters most for policyholders. Confining Privileged to the monitoring namespace means the exception does not spread to other workloads. Inês also notes that analytics enforces nothing while running code written by data scientists, which raises its priority. She marks pricing and quotes as the first namespaces to move to audit mode.
3.4 Evidence quality
The data come from live namespace labels exported on one date; Inês records the export time and checks a sample manually. Labels can change at any time, so a single export shows the state on one day only. Recording the time lets later exports be compared with this one. The manual sample checks that the export reflects what the API server actually enforces, not just what labels say. Inês keeps the export and her notes with the evidence for the risk committee, so the figure can be traced to its source if questioned.
3.5 Communicating
For the risk committee, a single coverage figure and a list of customer-data namespaces unenforced; for engineers, the full table. The risk committee needs to know how much of the estate is protected and whether customer data is exposed, not the label of every namespace. Engineers need the full namespace table, because each fix is applied one namespace at a time. Inês keeps both versions consistent by producing them from the same export, and she includes the export date on each, so nobody compares figures from different days without knowing it.
Behaviour tests
To confirm labels match behaviour, Inês submits a synthetic privileged pod to one enforced and one unenforced namespace in each cluster's test environment. Enforced namespaces reject it; unenforced ones admit it, matching the label data. She records each test with the cluster version and time. The tests also reveal that one cluster's admission configuration sets a cluster-wide default of Privileged for unlabelled namespaces, which explains why the gap was silent: nothing failed, so nobody noticed.
Worked example
Inês notices analytics has no enforcement at all, but its notebooks run code written by data scientists. She ranks analytics with quotes-prod as first priority, despite analytics holding less customer data, because arbitrary code runs there.
Synthetic case. Clusters and labels are synthetic.
Errors and limits
Labels show intended enforcement; test behaviour to confirm.
Exercises
- EX011 — Estate coverage. What was estate coverage? Rubric: 3 = 4/11, 36%; 2 = partial; 1 = vague; 0 = none.
- EX012 — quotes-prod. What was quotes-prod's state? Rubric: 3 = 0/2 enforced; 2 = partial; 1 = vague; 0 = none.
- EX013 — monitoring. Why does monitoring's label not count? Rubric: 3 = Privileged enforces nothing; 2 = partial; 1 = vague; 0 = none.
- EX014 — analytics priority. Why rank analytics first? Rubric: 3 = arbitrary code in notebooks; 2 = partial; 1 = vague; 0 = none.
- EX015 — Evidence check. How did Inês check evidence quality? Rubric: 3 = recorded export time; manual sample; 2 = partial; 1 = vague; 0 = none.
Synthesis
Detailed evidence turns an audit finding into a plan.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →