You've spent this chapter building security knowledge piece by piece: the 4C model in Lesson 1, RBAC in Lesson 2, NetworkPolicies in Lesson 3, secrets in Lesson 4, PSS in Lesson 5, image scanning in Lesson 6, Dapr security in Lesson 7, and compliance mapping in Lesson 8. Now you apply everything together.
In December 2023, a startup lost their Series A funding when a security audit discovered their "production-ready" Kubernetes deployment was running pods as root, had no network segmentation, and stored database credentials in environment variables visible to any cluster user. The technical fix took two days. The reputation damage took six months to repair.
This capstone produces a Task API deployment that would pass that audit. You'll write a security specification first, compose all security controls into a unified deployment, execute a 10-point audit, run penetration test scenarios to verify controls work, and document your security posture for compliance evidence.
Before implementing anything, define what "secure" means for your Task API. This specification becomes your acceptance criteria.
Application: Task API (FastAPI + SQLModel) Target Environment: Production Kubernetes namespace Compliance Context: SOC2 Type II preparation
Non-Goals (explicitly excluded):
Apply the security components you've built throughout this chapter. Each file references patterns from its source lesson.
Create 01-namespace.yaml:
Create 02-rbac.yaml:
Create 03-network-policy.yaml:
Create 04-secrets.yaml:
Create 05-dapr-components.yaml:
Create 06-deployment.yaml:
Output:
Execute each audit check with its verification command. All items must pass before declaring the deployment production-ready.
Command:
Expected Output: task-api-sa
Pass Criteria: Output is task-api-sa, not default.
Allowed operation:
Expected Output: yes
Denied operations:
Expected Output: no
Pass Criteria: ConfigMaps allowed in own namespace, secrets denied, other namespaces denied.
Command:
Expected Output: ["Ingress","Egress"]
Pass Criteria: Both Ingress and Egress policy types present with empty selectors (default deny).
Command (run from within a Task API pod):
Expected Output:
Pass Criteria: DNS resolution succeeds despite default-deny egress.
Detection command:
Expected Output: No secretKeyRef in env vars
Verify volume mount exists:
Expected Output: /secrets
Pass Criteria: No secretKeyRef in environment variables, secrets mounted at /secrets.
Command:
Expected Output: deployment.apps/task-api created (server dry run)
Pass Criteria: No PSS violations reported, deployment accepted (restricted labels active).
Command:
Expected Output:
Pass Criteria: Exit code 0, zero CRITICAL vulnerabilities.
Command:
Expected Output: dapr-sentry dapr-system True Running...
Verify certificate validity:
Expected Output: notAfter=Jan 15 10:23:45 2025 GMT
Pass Criteria: Sentry healthy, certificates not expired.
Command (from a pod with different app-id):
Expected Output: {"errorCode": "ERR_STATE_STORE_NOT_FOUND", ...}
Pass Criteria: Non-scoped app-ids cannot see the statestore.
Command:
Expected Output: true
Pass Criteria: Annotation present and set to "true".
Combine all checks into an executable audit script secure-task-api-audit.sh:
Security controls are only valuable if they actually prevent attacks. These scenarios verify your controls work against realistic attack vectors.
Attack: Compromised pod attempts to read secrets across namespaces.
Setup/Execution:
Expected Result: Error from server (Forbidden): ... cannot list resource ...
Attack: Compromised pod attempts to reach services outside allowed NetworkPolicies.
Setup/Execution:
Expected Result: curl: (28) Connection timed out...
Attack: Pod attempts to run privileged container or escape PSS restrictions.
Execution: kubectl apply -f privileged-attacker.yaml
Expected Result: Error from server (Forbidden): ... violates PodSecurity "restricted:latest"...
Create documentation for compliance auditors. This template maps your controls to common compliance frameworks.
Test your ability to design, implement, and audit production security configurations.
Prompt 1:
What you're learning: Security specification design requires understanding threat models before implementation. PCI-DSS adds requirements beyond standard production security: encrypted data at rest, stricter network segmentation, key rotation policies. Notice how your specification changes when compliance requirements increase.
Prompt 2:
What you're learning: Security is about risk management, not zero vulnerabilities. The decision depends on: Is the vulnerable code reachable? Is there a known exploit? What's the remediation timeline? Distroless images reduce attack surface but may break your application. This requires analyzing tradeoffs, not following rules.
Prompt 3:
What you're learning: Penetration testing validates that security controls actually work. The key insight is that scopes are enforced by app-id, so your test needs a pod with a different Dapr app-id annotation. The test should be non-destructive (read attempts, not writes) and cleanup after itself.
A 10-point audit provides evidence that controls are configured correctly at a point in time. Production security requires continuous monitoring: alert on RBAC changes, track NetworkPolicy modifications, scan images on schedule. This capstone establishes your security baseline; operational practices maintain it.