# Take the Lex Imperfecta Challenge: Quis Custodiet \[Expert\] **URL:** \ **Category:** Challenges\ **Tags:** lex-imperfecta-challenge\ **Created:** [July 29, 2026, 11:00am UTC](https://community.dynatrace.com/t/take-the-lex-imperfecta-challenge-quis-custodiet-expert/56591 "2026-07-29T11:00:11Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MichalGebacki](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/michalgebacki/32/41585_2.png) [@MichalGebacki](https://community.dynatrace.com/u/MichalGebacki)\ **Post date:** [July 29, 2026, 11:00am UTC](https://community.dynatrace.com/t/take-the-lex-imperfecta-challenge-quis-custodiet-expert/56591/1 "2026-07-29T11:00:11Z")
| Level: Expert | | --- | 👉 This Challenge, with all of its three levels, created Katharina Sick ([@ksick](https://community.dynatrace.com/user/43154)) from the [**OffOn Community**](https://offon.dev)! This Challenge Level is best suited for: | | Security engineers and platform engineers who want to explore the boundary between admission control and runtime security. Completing the Intermediate level first is helpful but not required. You should be comfortable reading Kyverno ValidatingPolicies and CELCommon Expression Language expressions. No prior Falco experience required. | | --- | --- | | Mission objective | | **The Praetorian Guard awake** : Falco fires an alert every time an unauthorized process reads the census archive, with live alerts streaming into the Falcosidekick UI | | | **The gate closed** : the intruder is denied re-admission. The policy that kept privileged containers out now covers every path to unchecked host power | | | **The archive sealed** : the census-archive secret is inaccessible to any workload that does not bear the Archivist role | | | **The empire-wide laws holding** : all intermediate-level checks still green across every province | |   | Key Learnings | | How [Falco rules](https://falco.org/docs/reference/rules/) are structured: conditions, output, and kernel-level fields, and how to write a rule targeting a specific runtime behaviour | | | Why `privileged: false` is not enough: how [Linux capabilities](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container) grant host-level access without the privileged flag | | | How to use [spec.variables](https://kyverno.io/docs/policy-types/validating-policy/) in a `ValidatingPolicy` to share reusable CEL expressions across validations | | | How pod volumes reference secrets, and why a volume's name and the secret it mounts are two separate fields in the pod spec and how [Falcosidekick](https://github.com/falcosecurity/falcosidekick) aggregates Falco alerts and how to use its UI to watch a runtime incident in real time | | This Challenge’s Level story: The Republic’s defences have always rested on the law: block the wrong workloads at the gate, and nothing bad gets in. But the Senate’s Praetorian Guard was built for a different threat: the workload that slips through and acts badly at runtime. The Guard watches the provinces through Falco, but tonight, the watchtower is dark. Someone broke the rule that should fire when the census archive is touched. The Guard sees nothing. And while the Guard slept, an intruder crept in. It declared valid labels, passed the census, and presented itself as a loyal citizen of the Republic. Its papers were in order. Its power was not. Once inside, it reached straight for the census archive: the imperial rolls of every citizen, sealed records it had no right to touch. It reads them on a loop and tries to send them out of the Republic. This Challenge Level’s architecture: | | The estate inherits the full intermediate topology: four province namespaces (`gallia`, `hispania`, `britannia`, `aegyptus`) and one infra namespace (`castra`), each labelled as before. Alongside the Kyverno stack and Policy Reporter, the cluster now runs **Falco** (eBPFextended Berkeley Packet Filter-based, as a DaemonSet) and **Falcosidekick** with its UI at port **30111**. At startup, an intruder pod is already running in one of the provinces, quietly reading the census archive: imperial rolls that only workloads bearing the `republic.rome/role: archivist` label are permitted to access. | | --- | --- | | | Your working directory is the challenge root. `manifests/secrets/` and `manifests/workloads/` are already in place. They define the estate and the intruder, and need no changes. Everything else is yours to investigate and fix. | Walkthrough 1. Get started **[Open in GitHub Codespaces](https://github.com/codespaces/new/dynatrace-oss/open-source-challenges?devcontainer_path=.devcontainer%2Flex-imperfecta_expert%2Fdevcontainer.json&quickstart=1)**. The devcontainer is pre-configured and starts automatically. When you push from Codespaces, GitHub forks the repository to your account automatically. Prefer working locally? [Clone the repo](https://github.com/dynatrace-oss/open-source-challenges) and open it in any editor that supports the Dev Containers specification (VS CodeVisual Studio Code, JetBrains, and others). The devcontainer config will be detected automatically. 2. Survey the Scene When your Codespace opens, the intruder is already running. Open the **Falcosidekick UI** at the forwarded port **30111**. It should be streaming alerts about census archive reads, but it is silent. That silence is your first clue that something is wrong with the Guard. **Start by getting oriented:** ```bash # Can you find the intruder? kubectl get pods -A # Read the Falco rule that should be firing cat falco-rules.yaml # Which policies are in force? kubectl get validatingpolicies kubectl get namespacedvalidatingpolicies -A ``` Open Policy Reporter at port 30110 as well. The intermediate estate should look clean: the intruder left no trace at admission. That is part of the problem. 3. Act I: Wake the Praetorian Guard The Falco rule in `falco-rules.yaml` has a defect: find the break, fix it, and run `make apply`; alerts streaming into the **Falcosidekick UI at port 30111** are your signal. The [Falco condition fields reference](https://falco.org/docs/reference/rules/supported-fields/) documents every available field. 4. Act II: Close the Gate The intruder passed admission: find the policy gap that let it through, close it, and run `make apply`; re-admission denied and the **Falcosidekick UI** going quiet confirm Act 2 is done. The existing policy already uses [spec.variables](https://kyverno.io/docs/policy-types/validating-policy/) to share expressions across validations, a pattern worth exploring. 5. Act III: Seal the Archive Open `manifests/policies/`: something is missing; the other policies show the structure, write what’s needed, then run `make apply`. **Going further:** even with the archive sealed at admission, any workload admitted with the Archivist role can read the secret. Kubernetes RBACRole-Based Access Control can restrict which service accounts may `get` a secret at the APIApplication Programming Interface level, a complementary layer that admission control alone cannot provide. How to complete your challenge? | | When you push from Codespaces, GitHub forks the repository to your account automatically. If you are working locally, fork the repository on GitHub before pushing. | | | Verify your solution: ``` ./verify.sh ``` | | | If it passes, it generates a Certificate of Completion you can paste into the discussion. | | | **Share your solutions in this thread in answer below**  and mention your achievement on your LinkedIn account! | | Toolbox[kubectl - Apply and inspect cluster resources, check pod status and security contexts](https://kubernetes.io/docs/reference/kubectl/)[k9s - Explore cluster resources, pod logs, and policy reports in a terminal UI](https://k9scli.io/)[kyverno - Test a policy against a resource locally before applying it to the cluster](https://kyverno.io/docs/kyverno-cli/) |   | Helpful documentation[Falco Rules Reference](https://falco.org/docs/reference/rules/)[Falco Condition Fields](https://falco.org/docs/reference/rules/supported-fields/)[Linux Capabilities in Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container)[Kyverno ValidatingPolicy](https://kyverno.io/docs/policy-types/validating-policy/)[CEL Validation Expressions](https://kubernetes.io/docs/reference/using-api/cel/)[Falcosidekick](https://github.com/falcosecurity/falcosidekick) | | Are you ready? Take the challenge’s mission! [Open in Codespaces](https://github.com/codespaces/new/dynatrace-oss/open-source-challenges?devcontainer_path=.devcontainer%2Flex-imperfecta_expert%2Fdevcontainer.json&quickstart=1) | | Free GitHub account required. | | | Launch in a preconfigured devcontainer. | |   | Don’t forget about benefits! | | **For completing at least one level** you get a unique badge! | | | **For completing all of the three levels** you get even more badges! | | | **Deadline:** 11 August 2026 at 23:59 CET | | Other levels of this challenge | [Beginner](https://community.dynatrace.com/post/301932) | Governing the Provinces | | --- | --- | | [Intermediate](https://community.dynatrace.com/post/302256) | Lex Imperfecta | ---
**Author:** ![tracegazer](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/tracegazer/32/32785_2.png) [@tracegazer](https://community.dynatrace.com/u/tracegazer)\ **Post date:** [July 29, 2026, 3:54pm UTC](https://community.dynatrace.com/t/take-the-lex-imperfecta-challenge-quis-custodiet-expert/56591/2 "2026-07-29T15:54:36Z")
🏆 Challenge Completed! --- CERTIFICATE START --- Adventure: 05-lex-imperfecta Level: expert User: Alan Repo: dynatrace-oss/open-source-challenges Date: Wed 29 Jul 2026 02:59:54 PM UTC Url: [Lex Imperfecta expert: activate Falco census rule, close the capabili… · tracegazer/open-source-challenges@227360b · GitHub](https://github.com/tracegazer/open-source-challenges/commit/227360b) --- CERTIFICATE END --- ---
**Author:** ![dannemca](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/dannemca/32/7215_2.png) [@dannemca](https://community.dynatrace.com/u/dannemca)\ **Post date:** [August 3, 2026, 1:46pm UTC](https://community.dynatrace.com/t/take-the-lex-imperfecta-challenge-quis-custodiet-expert/56591/3 "2026-08-03T13:46:46Z")
--- CERTIFICATE START --- Adventure: 05-lex-imperfecta Level: expert User: dannemca-persnonal Repo: dynatrace-oss/open-source-challenges Date: Mon Aug 3 13:46:20 UTC 2026 Url: [Solved Challenge · dannemca-persnonal/open-source-challenges@9b50fce · GitHub](https://github.com/dannemca-persnonal/open-source-challenges/commit/9b50fce) --- CERTIFICATE END ---