s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

الفصل 12الاسم في الدورة: Put it together

Put the services together in one platform

Knowing 65 tools one by one is not the goal. Companies want people who can join them into a working, secure platform. This chapter shows one reference platform that uses most services of this guide — a good target for a home lab and a portfolio.

  • 4 الدروس
  • 42 الأوامر

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

12.1

Build the reference platform

One small app ("shop"), from commit to production, with security at every step.

LayerChoiceServices
Code and reviewGitHub, protected main, signed commitsgit, gh
CIGitHub Actionssemgrep, gitleaks, trivy, docker, syft, cosign
InfraAzure or a home labterraform, packer, ansible, cloud-init, az
Clusterk3s (lab) or AKS (cloud)kubectl, helm, kustomize, etcdctl
DeliveryGitOpsargocd or flux, sops
EdgeIngress + TLSnginx (ingress-nginx) or traefik, cert-manager
DataDB + cachepsql, redis-cli
Identity and secretsSSO + secret storekcadm (or Entra ID), vault (or Key Vault)
ObserveMetrics, logs, traces, alertspromtool, amtool, grafana-cli, logcli, fluent-bit, otelcol
ProtectRuntime and benchmarksfalco, kube-bench, Pod Security, NetworkPolicies
TestFrom outsidezap, nmap

12.2

Follow one change through the platform

What happens when you change one line of code.

  1. You push a branch and open a PR with gh pr create.
  2. CI runs semgrep, gitleaks, trivy fs and unit tests; the PR shows the results.
  3. After review and merge, CI builds the image with docker, scans it with trivy, makes an SBOM with syft, signs it with cosign and pushes it.
  4. CI changes the image tag in the GitOps repo (kustomize edit set image).
  5. argocd sees the new commit and syncs the cluster; Kyverno checks the signature first.
  6. Prometheus and Loki show the new version; an alert fires if the 5xx rate rises; argocd app rollback or git revert brings the old version back.
  7. Every night: zap baseline on staging, grype on all SBOMs, kube-bench and falco reports, etcdctl and database backups.

12.3

Start small in the home lab

The order to build it, one weekend per step.

  1. 3 VMs with RHEL (or Rocky/Alma), hardened with Ansible; BIND for lab.local; WireGuard for access.
  2. k3s with 1 server + 2 agents; Traefik or ingress-nginx; cert-manager with a lab CA.
  3. Argo CD from a GitOps repo; SOPS with age for secrets.
  4. kube-prometheus-stack + Loki + Fluent Bit; 3 alerts and 1 dashboard.
  5. The CI pipeline with scans, SBOM and signing; Kyverno to enforce signatures.
  6. Falco, kube-bench and a weekly nmap of the lab network.
  7. Backups: etcd snapshots, pg_dump, mc mirror to MinIO; one restore test.

في العمل

Write a short README with a diagram and "what I learned" for each step. Link it from your CV and LinkedIn — see the portfolio chapter.

12.4

Map the services to the exams

Where the services of this guide appear in the certificates of the path.

ExamServices you must know
RHCSA (EX200)firewall-cmd, auditctl basics, podman, SELinux, nginx/httpd basics
AZ-104az, VNets, NSGs, Key Vault, Azure Monitor
Terraform Associateterraform (all commands, state, modules)
CKAkubectl, helm, kustomize, crictl, etcdctl
CKSfalco, kube-bench, trivy, cosign ideas, auditctl-style audit policies, NetworkPolicies

تذكّر

Tools change; the ideas stay: least privilege, everything as code, scan early, sign what you ship, watch what runs, and test your restores.

كل الأوامر في هذا الفصل