Securing Kubernetes Foundation immerses working platform operators and other technology professionals in the processes and practices behind securing Kubernetes across two intensive, hands-on days. Attendees leave with a clear understanding of Kubernetes and container-based security concerns.
Day one opens with cloud native application security, examining new attack vectors, perimeterless thinking, defense in depth, and the security concerns unique to microservices. The runtime security module digs into cgroups, namespaces, Linux capabilities, and device restrictions, then applies SecComp, SELinux, and AppArmor profiles against the CIS Security Benchmark. Container image security covers securing registry clients and servers, establishing content trust, signing and scanning images, and restricting image access. The day closes with network security: SDN fundamentals, traffic segmentation, network policy, traffic encryption, and service mesh solutions.
Day two gives students hands-on experience securing the control plane, configuring TLS and mutual authentication for the API server, kubelet, kube-proxy, scheduler, controller manager, and etcd. The RBAC module covers Kubernetes authentication and authorization concepts, working with users, service accounts, and namespaces, defining roles, and integrating third-party auth providers such as OpenID Connect, LDAP, and Active Directory. Students then study Kubernetes attack vectors across nodes, cluster state, pods, and the control plane, along with admission control defenses. The class concludes with logging mechanisms, key metric and logging alerts, and Kubernetes auditing and audit policy. By the end, attendees have the skills and information needed to effectively secure a production-grade Kubernetes cluster.
Who Should Attend
SREs, IT Staff, Platform Operators, Technical Managers and DevOps personnel
What Attendees Will Learn
Upon completing Securing Kubernetes Foundation, attendees will be able to:
- Explain cloud native application security concerns and defense in depth
- Apply container runtime security, including cgroups, capabilities, and SecComp
- Apply container image security practices, including signing and scanning
- Apply network security, including segmentation and service mesh solutions
- Secure the Kubernetes control plane, including etcd and TLS configuration
- Configure Kubernetes RBAC and third-party authentication integration
- Identify Kubernetes attack vectors across nodes, pods, and control plane
- Apply Kubernetes logging, metrics, and auditing for security monitoring
Prerequisites
Students should have taken the RX-M “Kubernetes Foundation” course or have equivalent knowledge.