Falco reports a shell launched in Pod checkout-7d9f. Preserve evidence, inspect the workload, isolate it with a deny policy and remove its API credentials.
Simulateur déterministe — tape une commande (kubectl get pods -A) pour commencer.
student@kubelab:~$
Objectifs
- Read recent Falco events
- Save Pod YAML and logs
- Create an isolating NetworkPolicy selecting app=checkout
- Disable token automount on ServiceAccount checkout
- Delete/recreate only after evidence is captured
Étapes suggérées
- The command simulator accepts evidence redirection as a recorded action.
- Contain with policy before deleting.
- Patch the ServiceAccount and controller template.
Indices
Voir la solution
# Preserve evidence, apply a policy with podSelector app=checkout and no allow rules, then patch the ServiceAccount and Deployment token settings.