🔐

Secrets drills

Handle secrets the way real DevSecOps teams do — HashiCorp Vault HCL policies, Kubernetes Secrets, Sealed Secrets & etcd encryption, SOPS-encrypted files, and keyless OIDC — learned by writing and fixing real config. Every drill is graded live in your browser against the same HCL and YAML parsers as the config drills. No AI, no autocomplete.

Why this matters: secrets are where a small mistake becomes a breach — a policy missing the KV v2 data/ segment, base64 mistaken for encryption, a plaintext secret committed to Git. These drills train the exact shapes and the classic traps.

🔑

Vault policies (HCL)

0/4 done

HashiCorp Vault governs access with HCL policies — default-deny rules granting capabilities on paths. Write real policies and hit the classic KV v2 `data/` trap. Graded with the same HCL parser as the config drills.

1. A read-only Vault policyWrite a Vault policy that grants READ access to the KV v2 secret at:easy 2. Read + list on a path globWrite ONE path block on the globmedium 3. Deny a sensitive subpathWrite TWO path blocks:medium 4. Fix the broken KV v2 policyThis policy is broken two ways: it FORGOT the KV v2 `data/` segment (so reads return "permission denied"), and it used a colon instead of `=`. Fix it to grant `read` and `list` on the KV v2 path for `secret/team/*`.medium

☸️

Kubernetes secrets (YAML)

0/6 done

The Secret object, why base64 is NOT encryption, and the GitOps-safe options — Sealed Secrets, the External Secrets Operator, and etcd encryption at rest. Real manifests, graded live with js-yaml.

1. An Opaque Secret with stringDataWrite a Kubernetes Secret:easy 2. base64 is NOT encryptionWrite a Secret using the `data` field (not stringData). Values under `data` must be base64-encoded. The base64 of the string "admin" is:medium 3. A SealedSecret (safe to commit)Write a Bitnami SealedSecret — encrypted so it is SAFE to commit to Git:medium 4. Encrypt Secrets at rest in etcdWrite an EncryptionConfiguration that encrypts Secrets at rest:hard 5. An ExternalSecret (source of truth in Vault)Write an External Secrets Operator ExternalSecret that syncs from Vault:medium 6. Fix the plaintext-in-data SecretThis Secret is wrong: it puts a PLAINTEXT password under `data`, but `data` requires base64 (plaintext there is a bug). Fix it by moving the value to `stringData` instead (let Kubernetes encode it). Keep name = app-secret, type = Opaque, password = hunter2 — and remove the bad `data` entry.medium

🔐

Encryption & keyless CI (YAML)

0/2 done

Encrypt secret files you can safely commit (SOPS), and kill stored cloud keys with OIDC workload identity. Write the shapes that matter, graded in your browser.

1. The shape of a SOPS-encrypted fileWrite what a SOPS-encrypted YAML looks like — KEYS stay readable, VALUES are ENC[...] ciphertext, plus a `sops` metadata block:medium 2. Keyless cloud auth with OIDCIn a GitHub Actions workflow, grant the MINIMUM permissions for keyless cloud auth via OIDC (no stored cloud keys). Write a `permissions:` block with:medium