A platform secret is not an empty config row | Rapid course Cloud and container security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 15. Map, example, EX061.

flowchart TD
  C["booking-app-config at admins"] --> R["Sensitive, and not in bad"]
  S["Password moved and changed"] --> P["Prose about the platform setting"]
  R --> Q{"Does the passing row prove the file is empty?"}
  P --> Q
  Q -->|No| K["The row and the prose stay separate"]

A passing triple does not describe the bytes inside the object.

Logical drawing

triple:   booking-app-config , admins , True
prose:    database password moved to platform secret settings, then changed
absent:   the password, a Secret object, a statement that the file is empty

Learning outcomes

After this chapter, you should be able to:

Read the config triple as a sharing result.
Keep the password move in prose.
Refuse both a printed secret and an emptiness proof.

15.1 The row answers a sharing question only.

booking-app-config is True and admins. admins is a member of allowed[True], so the comprehension does not print the name. The triple does not say what bytes are inside the object. The prose says the developer moved the database password into the platform's secret settings and then changed it, because the old value may already have been copied. That paragraph is not loaded by the filter.

staff and admins are equal in the set test. Calling admins narrower is a human gloss. The program would also have accepted staff for this sensitive object. Kubernetes documents good practices for Secret objects. This platform is not a Kubernetes cluster, and no Secret manifest is in the file. The guidance is an analogy for keeping a value out of an image, not a result printed for Oakfield.

The password is not written here. old-backup.zip is a separate triple, described as a copy from the previous system. This chapter does not claim the zip contains the booking password. Copies of a configuration file are the prose concern in the password paragraph; the zip's contents are not itemised beyond that earlier description.

15.2 Worked example

Lesson table; scroll horizontally to read all columns →

Claim	What would show it	Decision
The config triple passes	`admins` is allowed	Keep
The password was moved and changed	Prose	Keep, value unprinted
"The passing row proves the file no longer holds the password."	The triple has no content field	Reject
"admins is computed as stricter than staff."	Both are mere members	Reject

Synthetic case. No password characters appear in the book.

Errors and limits

Do not fill the blank with an example secret. The absence of a value is the point.

Apply

EX061 — Row versus move. A note says the passing config row proves the password is gone, prints a sample password, and says admins outranks staff inside the program. What do you reject, and what stays?
Show marking criteria
Rubric: 3 = reject the emptiness proof, the sample, and the ranking; the triple stays sensitive, admins, and out of bad; the move and the change stay prose;; 2 = the row stays and the secret stays unprinted;; 1 = one point;; 0 = none.