Course Objective & Scope
When a service goes down in a production Kubernetes cluster, engineers must quickly tell whether the root cause is a restrictive NetworkPolicy, CoreDNS latency or an OOMKilled pod. This course combines practical cluster security controls with systematic fault diagnosis.
RBAC permission audits, Pod Security Standards, NetworkPolicy traffic analysis, `kubectl debug` with ephemeral containers, CNI/DNS/Ingress packet tracing, PVC/CSI mount errors and kubelet/etcd/API Server failure scenarios are solved on intentionally broken clusters. Participants leave with an incident response runbook tailored to their environment.
Who Should Attend?
- SRE, DevOps and platform engineers operating production Kubernetes clusters
- Infrastructure specialists with on-call incident response responsibilities
- Senior software developers debugging runtime microservice issues
- Prerequisite: hands-on experience with Kubernetes objects and the Linux CLI
Key Takeaways
- Quickly pinpoint the root cause of Pending, ImagePullBackOff, CrashLoopBackOff and OOMKilled pods
- Inspect distroless pods live using `kubectl debug` and ephemeral containers
- Diagnose connectivity drops across CoreDNS, kube-proxy, CNI plugins and NetworkPolicies
- Audit RBAC permission errors (`auth can-i`), ServiceAccount tokens and API Server audit logs
- Execute step-by-step recovery runbooks for control plane, etcd and NotReady node failures
Curriculum
Pod and Application-Layer Troubleshooting
- Analysing Pending, CrashLoopBackOff, OOMKilled and probe failures
- kubectl debug, ephemeral containers and exit code inspection
Networking, DNS and NetworkPolicy Diagnostics
- Debugging Services, EndpointSlices, kube-proxy (iptables/IPVS/eBPF) and CoreDNS
- Testing NetworkPolicy rules and tracing CNI traffic (Hubble/tcpdump)
Access Security, RBAC and Audit Logs
- Role/ClusterRole mismatches, kubectl auth can-i and least-privilege checks
- Pod Security Standards (Privileged, Baseline, Restricted) and SecurityContext
- Analysing API Server audit logs
Storage, Node and Control Plane Failures
- PVC Pending states, VolumeAttachments and CSI driver errors
- kubelet, containerd, disk/PID pressure and recovering NotReady nodes
- API Server, Scheduler and etcd health checks
Live Break-Fix Cluster Workshop
- Timed resolution of multi-layer failure scenarios
- Enterprise Kubernetes incident response runbook template
Other Courses in This Category
-
End-to-end container and Kubernetes security across the 4Cs: image scanning (Trivy), SBOMs and Cosign signing, Linux isolation (seccomp, AppArmor), CIS Benchmark hardening, Kyverno/OPA Gatekeeper and runtime detection with Falco/Tetragon.
- Live Course
- 5 modules
-
Docker for application containerisation: container lifecycle, multi-stage Dockerfile authoring, image slimming and security, volumes and networking, multi-service environments with Docker Compose and CI/CD integration.
- Live Course
- 5 modules
-
Container orchestration with Kubernetes: Pods, Deployments, StatefulSets, Services and Ingress/Gateway API, ConfigMaps and Secrets, PVC storage, autoscaling with HPA, resource management and production cluster operations.
- Live Course
- 5 modules
-
Packaging and release management on Kubernetes with Helm: chart structure, Go templates and Sprig functions, per-environment values files, dependencies, OCI registry distribution, hooks and chart testing.
- Live Course
- 5 modules
-
Managed Kubernetes on AWS EKS, Azure AKS and Google GKE: cluster design, IAM/Workload Identity, VPC CNI networking, CSI storage, scaling with Karpenter and Cluster Autoscaler, version upgrades and cost optimisation.
- Live Course
- 5 modules
Get in touch
