Chapter 17 — Contained laboratory II
Lesson map
Lesson 17 published. Map, example, EX065.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Drift"]
N2["Lab — drift check"]
N3["17.2 Reading the result"]
N4["17.3 Judging"]
N5["17.4 Fixing"]
N6["17.5 Prevention"]
N7["Fix live or update the declaration"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX065"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Drift"]
N2["Lab — drift check"]
N3["17.2 Reading the result"]
N4["17.3 Judging"]
N5["17.4 Fixing"]
N6["17.5 Prevention"]
N7["Fix live or update the declaration"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX065"]
[Learning outcomes]
|
v
[17.1 Drift]
|
v
[Lab — drift check]
|
v
[17.2 Reading the result]
|
v
[17.3 Judging]
|
v
[17.4 Fixing]
|
v
[17.5 Prevention]
|
v
[Fix live or update the declaration]
|
v
[Worked example] --> [Exercise EX065]
Learning outcomes
You will (1) detect drift between declared and live settings; (2) decide which drift to fix; (3) prevent recurrence.
17.1 Drift
Drift is a difference between what the repository declares and what is live, usually from manual changes. Drift matters at Fairway because the repository is now the declared state that reviews, checks and auditors rely on. A manual change in the console, such as opening the cluster endpoint for a vendor, makes the live system differ from what everyone believes. The drift check compares the two and lists every difference. In the lab, the repository and live settings for seven items are compared with synthetic values.
Lab — drift check
"""Compare declared (repository) settings with live settings to find drift (synthetic, stdlib only)."""
declared = {"manifests.block_public_access": True, "manifests.versioning": True, "site-assets.access_logging": True,
"cluster.audit_logging": True, "cluster.public_endpoint": False, "tracker.replicas": 2, "tracker.run_as_root": False}
live = dict(declared, **{"site-assets.access_logging": False, "cluster.public_endpoint": True, "tracker.replicas": 3})
drift = [(k, declared[k], live[k]) for k in declared if declared[k] != live[k]]
print(f"settings {len(declared)}, drifted {len(drift)}")
for k, d, l in drift: print(f" {k}: declared {d}, live {l}")
Run with python3 lab_drift.py. Verified output:
settings 7, drifted 3
site-assets.access_logging: declared True, live False
cluster.public_endpoint: declared False, live True
tracker.replicas: declared 2, live 3
17.2 Reading the result
Three of seven settings drifted: site-assets access logging is off, the cluster public endpoint is on, and tracker replicas are 3 instead of 2. Each drifted item has a different cause and a different weight for security. Logging off on site-assets removes visibility, the public cluster endpoint exposes the control plane to the internet, and the extra replica only changes capacity. The other four settings, including the manifests public block and the tracker's non-root setting, match their declarations. The script prints only drifted items, so a clean night produces a single summary line.
17.3 Judging
The public endpoint matters most; logging next; replicas were raised during a busy week and are harmless but should be declared. An open cluster endpoint lets anyone on the internet attempt to reach the cluster's management interface, which is far more serious than missing logs. Logging comes second because it affects whether future problems can be investigated. The replica change helped during a busy week and carries no security risk, so it only needs declaring. Tomás records each judgement with its reason before any fix is made.
17.4 Fixing
The endpoint is restored to private through the repository; logging re-enabled; replicas updated in the repository to match. All three changes go through the repository, so the declared and live states match again. The endpoint is closed first, then logging restored, then the replica count declared at 3. The next nightly run confirms zero drift, which supports the drift figure reported in the project results. Grace reviews the endpoint fix because it changes how the vendor reaches the cluster. The vendor's next support session uses a temporary account on the private network instead.
17.5 Prevention
The drift check runs nightly. A nightly run means a manual change such as the vendor endpoint would be noticed the next morning rather than weeks later. Results are posted with a count, so a rising number gets attention. Together with the one-working-day rule for urgent manual changes, the check keeps the repository a reliable description of the live system. After a month of nightly runs, drift averages under one item. Each remaining item is logged with the decision taken and the date.
Fix live or update the declaration
For each drift item, Tomás asks: was the live change needed and safe? If yes, update the repository so it becomes declared. If no, restore the live setting from the repository. The replicas change was needed and safe; the endpoint change was unsafe; logging being off was an accident. Writing the decision for each item keeps the repository as the single source of truth.
He adds a rule: urgent manual changes must be recorded in the repository within one working day.
Vendor access
Vendor access now uses a temporary account on the private network that expires after the session.
Worked example
Tomás finds that the endpoint was opened during a support call to let a vendor connect. Grace arranges vendor access through the private network instead.
Synthetic case. Synthetic.
Errors and limits
Not all drift is bad; decide whether to fix live or update the declaration.
Exercises
- EX065 — Lab result. Which settings drifted? Rubric: 3 = logging, endpoint, replicas; 2 = two; 1 = one; 0 = none.
- EX066 — Priority. Which drift mattered most? Rubric: 3 = public endpoint; 2 = partial; 1 = vague; 0 = none.
- EX067 — Replicas. How was the replicas drift handled? Rubric: 3 = declaration updated; 2 = partial; 1 = vague; 0 = none.
- EX068 — Endpoint cause. Why had the endpoint been opened? Rubric: 3 = vendor support call; 2 = partial; 1 = vague; 0 = none.
Synthesis
Compare declared and live often and decide each difference deliberately.
Continue studying — chapter 17 of 18
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →