Feature/lab10 - #17
Merged
Merged
Conversation
MikeNovikoff
commented
Jul 10, 2026
MikeNovikoff
commented
Owner
- Task 1 — DefectDojo setup + imports + dedup proof
- Task 2 — Governance report with MTTD/MTTR/SLA/backlog
- Bonus — 5-minute walkthrough script with timed practice
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
…EADME Task 1 jq broke on real Checkov output: a directory scan runs multiple frameworks (terraform + secrets), so results_json.json is a JSON array and .results.failed_checks[] errored with 'Cannot index array with string'. Use .[] to iterate frameworks. Open-source Checkov assigns no severities (a Prisma Cloud feature), so the severity breakdown is replaced with passed/failed and triage is framed around rule frequency. Pulumi was referenced in Task 1's report, acceptance criteria, and rubric but Checkov never scanned it (no pulumi framework; the 'shipped' rendered-state file never existed). Pulumi is scanned by KICS in Task 2 — moved its severity table there and fixed the Task 2 jq paths (kics-ansible/, kics-pulumi/ instead of a kics/ dir that is never created). Closed the 6.3 numbering gap. README aligned to the actual lab (Checkov + KICS + custom Checkov policy): dropped tfsec/Terrascan/OPA references, corrected Pulumi as AWS (not GCP), and removed the nonexistent EKS resource from the Terraform description. Reported by Albert Khechoyan. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Student-reported breakage where lab instructions assumed tool behavior the
pinned versions no longer have. Each fix verified against the real binaries.
Lab 7 (Trivy 0.69):
- 7.3 jq: add `installed: .InstalledVersion` so the 7.4 "Installed" column has data
- 7.7: `trivy k8s --namespace` was removed in 0.69 -> `--include-namespaces`
Lab 9 (Falco 0.43.1, Conftest 0.68):
- manifests are k8s/juice-{hardened,unhardened}.yaml, not flat good-pod/bad-pod
- 9.3 trigger B: a write to /usr/local/bin fires nothing in the 0.43.1 default
ruleset (rule moved to incubating feed) -> `cat /etc/shadow` (Read sensitive
file untrusted), confirmed firing in a live Falco run
- 9.4 hint: point at the real `open_write` macro instead of a non-existent rule
- bonus: `tcp.dport` -> `fd.sport` (real Falco field)
- add inotify pitfall + `-o watch_config_files=false` workaround for WSL2
- wire the shipped compose policy into 9.9 as a second target-shape demo
Reported by students in the DevSecOps-Intro cohort.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
…rule passes
The hardened manifest pinned its image by tag (:v19.0.0), so a student who
implements the optional 5th hardening rule ("image must use sha256 digest,
not :tag") saw the GOOD manifest FAIL — contradicting 9.9-A's "should PASS
(0 failures)". Pin by the resolved v19.0.0 multi-arch index digest; the
unhardened manifest (:latest) still fails the rule as the bad example.
Digest resolved via 'docker buildx imagetools inspect', not fabricated.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
…dened Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Docker Desktop's LinuxKit VM kernel lacks BTF + tracepoints, so Falco runs but detects nothing on Mac (esp. Apple Silicon). The Setup section wrongly said Docker Desktop 'is fine' — corrected it, and added a Common Pitfalls entry with the Colima fix and a 'test -f /sys/kernel/btf/vmlinux' gate check. Reported by a student on an M-series Mac. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
…macOS The run-imports.sh helper did not work as shipped: - Line 55 used mapfile, a bash 4+ builtin absent on stock macOS bash 3.2, so the script aborted on macOS. Replaced with a portable while-read loop and set -u-safe array handling; verified under bash 3.2.57. - Every hardcoded input path was wrong. Corrected to the real Lab 4-7 outputs and anchored them to the repo root so the script runs from any directory. - The script required DD_API while lab10.md tells students to export DD_URL, so require_env aborted immediately. It now accepts DD_URL and derives the API base. - It imported Nuclei (not in this course) and skipped Checkov/KICS/Trivy image/Trivy operator. It now imports exactly the documented Lab 4-7 table, with scan_type fallbacks verified against the DefectDojo 2.58.3 parser source. lab10.md aligned: correct script name (was import-all.sh), KICS split into kics-ansible/kics-pulumi, fixed the manual curl template path, and added the env.sample the plumbing promised. Importer outputs are now gitignored. Reported by Albert Khechoyan. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
The shipped nginx.conf listened on 8080/8443 and docker-compose.yml published 8080:8080/8443:8443, but every instruction and verification command in lab11.md assumes 80/443 (curl http://localhost, https://localhost, s_client -connect localhost:443, and the 11.1 spec 'HTTP on 80 -> HTTPS 443'). Following the lab gave connection-refused on 443. Switch nginx to listen 80/443, drop the :8443 from the redirect target, and publish 80:80/443:443. The juice backend stays behind the proxy on expose:3000 (verified end-to-end: nginx reaches juice:3000 with expose only, so publishing the backend on the host is unnecessary and would defeat the lab). Added a remap hint for rootless Docker / busy ports. Reported by Albert Khechoyan. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.