CKSKubernetes 1.35

Exercises

Exercise: find and remove the vulnerable workload

updated 2026-10-22 by seed

Host: controlplane · Time: 12 min · Domain: Supply Chain Security

Task

  • Scan the images of every running Pod in namespace prod.
  • Identify the Pod whose image has CRITICAL vulnerabilities.
  • Remove that workload so the Pod does not come back.

Acceptance criteria

  • The workload is gone (kubectl get all -n prod).
  • No Pod with that image is running.
  • You can name the CVE you acted on.

Solution

kubectl get pods -n prod -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.spec.containers[*].image}{"\n"}{end}'
trivy image --severity CRITICAL --ignore-unfixed nginx:1.21.6 | head -30
kubectl get pod <name> -n prod -o jsonpath='{.metadata.ownerReferences[*].kind}'

If it is owned by a Deployment:

kubectl delete deployment <name> -n prod

If it is a bare Pod, kubectl delete pod is enough. Deleting the Pod of a
Deployment just recreates it — that is the trap in this exercise.