This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Challenges
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Community Home
- Challenges
- Take the Lex Imperfecta Challenge: Governing the provinces [Intermediate]
Michal_Gebacki
Community Team
Options
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Printer Friendly Page
22 Jul 2026
02:36 PM
| Level: Intermediate |
👉 This Challenge, with all of its three levels, created Katharina Sick (@ksick) from the OffOn Community!
This Challenge Level is best suited for:
|
|
Platform engineers and SREs who have some familiarity with Kyverno, ideally after completing the Beginner level. You should be comfortable reading Kubernetes YAML and basic kubectl commands. |
|
Mission objective
|
Key Learnings
|
This Challenge’s Level story:
The Republic has grown. What once was a single city is now a sprawling empire of provinces, each governed by different magistrates with different needs. The legal scholars decided to catalogue every law in a central archive (the Tabularium) so that each province's statutes could be tracked and audited in one place.
But cataloguing the laws introduced new chaos. Policies meant for one province are bleeding into another. Exceptions that were meant to be narrow have been written too broadly. And somewhere in the estate, a workload is slipping through that shouldn't be.
The Tabularium's auditors have handed you a report: Policy Reporter shows violations where there should be none, and silence where there should be enforcement. Your mission: investigate the policy estate, fix the scoping issues, and restore order before the provinces descend into chaos.
This Challenge Level’s architecture:
|
|
Five namespaces span the estate: four provinces ( |
|
|
Two empire-wide policies cover all provinces: no-privileged-containers and require-census (every workload must declare a valid republic.rome/gens and a matching republic.rome/province). Aegyptus adds aegyptus-require-scribe-role for its local scribe requirement, and a PolicyException covers its single legacy workload. |
Walkthrough
1. Get started
Open in GitHub Codespaces. The devcontainer is pre-configured and starts automatically. When you push from Codespaces, GitHub forks the repository to your account automatically.
Prefer working locally? Clone the repo and open it in any editor that supports the Dev Containers specification (VS CodeVisual Studio Code, JetBrains, and others). The devcontainer config will be detected automatically.
2. Explore the Estate
When your Codespace is ready, the policy estate is already deployed, but something is wrong. Open Policy Reporter at port 30110 (find it in the Ports tab) to get an overview of the estate:
- Which namespaces have violations?
- Which policies are generating results, and which are silent when they shouldn't be?
Then dig into the cluster:
# Inspect the namespace topology — the labels here drive policy scoping
kubectl get ns --show-labels
# List all policies — note which are cluster-wide and which are namespaced
kubectl get validatingpolicies
kubectl get namespacedvalidatingpolicies -A
# Inspect any policy or exception in full
kubectl get validatingpolicy <name> -o yaml
kubectl get policyexceptions -A -o yaml
# See the raw OpenReports data behind Policy Reporter
kubectl get policyreports -AYou can also launch k9s for a terminal UI view:
k9s3. Fix the policies
Review the objectives of this mission that are visible in the top of this page and investigate what is wrong in manifests/policies/ andmanifests/exceptions/.
Think about what each policy is supposed to cover, and compare that against what it is actuallymatching. The namespace labels you saw with kubectl get ns --show-labels are a key part of the picture.
Test locally with the Kyverno CLICommand Line Interface before applying:
kyverno apply manifests/policies/require-census.yaml --resource manifests/workloads/citizens.yaml
kyverno apply manifests/policies/aegyptus-require-scribe-role.yaml --resource manifests/workloads/aegyptus-legacy-scribe.yamlApply your changes to the cluster:
Once you’re happy with your changes, re-apply everything:
make applyPolicies only act at admission, so make apply redeploys the workloads to re-evaluate the estate against your changes. Then check Policy Reporter again. The picture should improve as you fix each issue.
4. File the Audit
Once the estate is in order, the Senate expects the Tabularium's ledger on file. Export the cluster's policy reports, the OpenReports data behind Policy Reporter, as the audit of record.
kubectl get policyreports -A -o yaml > estate-audit.yamlHow to complete your challenge?
|
|
When you push from Codespaces, GitHub forks the repository to your account automatically. If you are working locally, fork the repository on GitHub before pushing. |
|
|
Verify your solution: |
|
|
If it passes, it generates a Certificate of Completion you can paste into the discussion. |
|
|
Share your solutions in this thread in answer below and mention your achievement on your LinkedIn account! |
|
Toolbox kubectl - Apply and inspect cluster resources kyverno CLI - Test and lint policies locally before applying |
Helpful documentation |
|
Are you ready? Take the challenge’s mission!
|
Don’t forget about benefits!
|
Other levels of this challenge
| Beginner | Lex Imperfecta |
| Expert | Quis Custodiet |
Labels:
3 Comments
