Course Objective & Scope
A vulnerable base image, an over-privileged container or unencrypted Secrets can let a single application exploit compromise an entire Kubernetes cluster. This course builds defence in depth across the 4Cs of Cloud, Cluster, Container and Code.
Linux kernel isolation (capabilities, seccomp, AppArmor), vulnerability scanning and SBOM generation with Trivy, image signing with Cosign, CIS Benchmark auditing with kube-bench, Policy-as-Code admission control with Kyverno/OPA Gatekeeper and eBPF runtime threat detection with Falco/Tetragon are practised hands-on. Participants leave with a policy set and hardening checklist for their own clusters.
Who Should Attend?
- Cloud security and DevSecOps engineers securing container platforms
- Platform and SRE teams managing Kubernetes infrastructure
- Specialists targeting CKS (Certified Kubernetes Security Specialist) level proficiency
- Prerequisite: intermediate Docker and Kubernetes administration experience
Key Takeaways
- Scan images with Trivy, generate SBOMs and sign artefacts with Cosign to secure the supply chain
- Restrict pods using Linux capabilities, read-only root filesystems, seccomp and AppArmor profiles
- Harden the control plane and etcd encryption against CIS Benchmarks using kube-bench
- Block non-compliant workloads at admission time with Kyverno or OPA Gatekeeper
- Detect suspicious container syscalls in real time using Falco and eBPF-based tooling
Curriculum
The 4C Security Model and Container Supply Chain
- 4C (Cloud, Cluster, Container, Code) attack surface and STRIDE analysis
- Distroless images, CVE scanning with Trivy, SBOMs with Syft/Grype and Cosign signing
Linux Isolation Primitives and Pod Hardening
- Namespaces, cgroups, dropping Linux capabilities and running as non-root
- SecurityContext, seccomp profiles, AppArmor and an overview of gVisor/Kata Containers
Cluster Hardening, Secret Protection and Network Isolation
- API Server flags and CIS Kubernetes Benchmark auditing with kube-bench
- etcd encryption at rest (EncryptionConfiguration) and external secret stores
- Zero-trust NetworkPolicies and mTLS with Cilium/Istio
Admission Control and Policy-as-Code
- ValidatingAdmissionPolicy, Kyverno and OPA Gatekeeper
- Enforcing signed images, required labels and security contexts automatically
Runtime Security and Incident Response
- eBPF-based syscall monitoring with Falco and Cilium Tetragon
- Detecting and isolating container escape and privilege escalation attempts
Other Courses in This Category
-
Docker for application containerisation: container lifecycle, multi-stage Dockerfile authoring, image slimming and security, volumes and networking, multi-service environments with Docker Compose and CI/CD integration.
- Live Course
- 5 modules
-
Container orchestration with Kubernetes: Pods, Deployments, StatefulSets, Services and Ingress/Gateway API, ConfigMaps and Secrets, PVC storage, autoscaling with HPA, resource management and production cluster operations.
- Live Course
- 5 modules
-
Packaging and release management on Kubernetes with Helm: chart structure, Go templates and Sprig functions, per-environment values files, dependencies, OCI registry distribution, hooks and chart testing.
- Live Course
- 5 modules
-
Managed Kubernetes on AWS EKS, Azure AKS and Google GKE: cluster design, IAM/Workload Identity, VPC CNI networking, CSI storage, scaling with Karpenter and Cluster Autoscaler, version upgrades and cost optimisation.
- Live Course
- 5 modules
-
Security controls and deep troubleshooting in production Kubernetes clusters: validating RBAC, Pod Security Standards and NetworkPolicies; diagnosing CrashLoopBackOff, OOMKilled, DNS/CNI networking, CSI storage and node failures.
- Live Course
- 5 modules
Get in touch
