Prove Encryption at Rest and in Transit (Information Disclosure)
Duration: ~20 minutes
Overview
201-11 Information disclosure: secrets in env, etcd plaintext, cleartext Routes. You already did the deep labs—101-08, 101-12, 201-08, 201-05. This module inventories and proves those controls on the current cluster, including the 301-02 Python Deployment not passing secrets in env.
This is not a post-quantum implementation lab.
Why it matters
Crypto that is “on the roadmap” does not help a stolen etcd snapshot. You need aesgcm/aescbc on the APIServer, TLS on the Route, and workloads that do not dump credentials into env:.
What does it solve
-
Assuming etcd encryption from a 101 lab that ran on a different cluster
-
Secret-as-env on the “hardened” Python app
-
Cleartext edge Routes after 101-12 was skipped
Your Mission
Read APIServer encryption, confirm the Python app has no Secret env, and check default IngressController redirect to HTTPS.
Click each step only if you need a hint.
etcd encryption type
oc get apiserver cluster -o jsonpath='{.spec.encryption.type}{"\n"}'
aesgcm or aescbc means encryption at rest is on. Empty or identity means 101-08 still applies—do not skip it on a real cluster.
|
No secret-as-env on the catalog Python app
oc get deploy python-app -n 301-02-python -o jsonpath='{.spec.template.spec.containers[0].env}{"\n"}' 2>/dev/null || echo "301-02-python not deployed — skip or re-run 301-02"
oc get deploy python-app -n 301-02-python -o json | jq -r '.spec.template.spec.containers[0].envFrom // empty'
Empty env / envFrom. Credentials belong in Vault/ESO (201-05) or SPIFFE (301-08), not valueFrom.secretKeyRef on this app.
|
Ingress HTTPS redirect
oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.spec.defaultCertificate}{"\n"}'
oc get ingresscontroller default -n openshift-ingress-operator -o yaml | grep -A2 -i redirect || true
oc get route -A | head
Edge Routes should be TLS (101-12). cert-manager (201-08) is how you get a globally trusted cert. .svc.cluster.local stays internal.
|
Vault still the KMS-adjacent pattern
oc get pods -n vault 2>/dev/null || echo "Vault not running — 201-05 is the install path if you need CSI secrets"| External keys and rotation live there; this lab does not reinstall Vault. |
Debrief
Information disclosure at 301 is proof: etcd type, no env secrets, TLS at the edge. Sandboxed isolation (Kata) is 201-09.
