← All challenges
mediumcloud~35 min

Secure a Kubernetes Deployment

A Deployment runs a privileged, root container with no resource limits and no health checks. Bring it up to a baseline pod-security standard the way a real cluster admission controller would demand.

Scenario

This Deployment would be rejected by any hardened cluster: the container is privileged, runs as root, has no resource limits (it can starve its neighbours), and has no health probes (the cluster can't tell if it's alive). Bring it up to a baseline pod-security standard.

Your job

Edit deployment.yaml so the container:

  • sets cpu and memory limits under resources,
  • runs as non-root (securityContext.runAsNonRoot: true),
  • is not privileged (remove privileged: true), and
  • has both a livenessProbe and a readinessProbe.

How it's graded

Structural check on the manifest (we parse the YAML; we don't deploy it), the same things an admission controller like Pod Security Admission or a Kyverno/OPA policy would enforce.

Teaches: Kubernetes pod-security baselines: limits, non-root, no privilege escalation, and health checks.

What gets checked

Your solution is verified against each of these:

  • The container sets cpu and memory limits
  • The pod/container runs as non-root (runAsNonRoot true)
  • The container is not privileged
  • The container has liveness and readiness probes

Solve it in your browser

No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.

Solve in browser →

Prefer your own lab?

  1. Build the fix locally. New to the tooling? See setting up your lab.
  2. Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
  3. Submit the repo link. We review it by hand, confirm it works, and issue your proof page.
Submit your solution →