Skip to Scheduled Dates
Course Overview
This class prepares students for the Certified Kubernetes Security Specialist (CKS) exam. Kubernetes is a Cloud Orchestration Platform providing reliability, replication, and stability while maximizing resource utilization for applications and services. Our Securing Kubernetes course emphasizes the skills and knowledge for securing container-based applications and Kubernetes platforms, during build, deployment and runtime. As a security expert in the DEVOPS world, your role is to observe and track activity. This means you need to understand processes without inserting secure systems or gatekeepers into the process and slowing it down. You must be able to observe rapidly progressing devops processes and pinpoint which container, process, or subsystem causes a security concern.
Who Should Attend
This course is ideal for anyone holding a CKA certification and interested in or responsible for cloud security.
Course Objectives
- Cluster Setup
- Cluster Hardening
- System Hardening
- Minimizing Microservices Vulnerabilities
- Supply Chain Security
- Monitoring, Logging and Runtime Security
- AI LLM prompt engineering for generating configuration snippets and solutions
Course Outline
Learning Your Environment
- Underlying Infrastructure
- Using Vim
- Tmux
Cloud Security Primer
- Basic Principles
- Threat Analysis
- Approach
- CIS Benchmarks
Securing your Kubernetes Cluster
- Kubernetes Architecture
- Pods and the Control Plane
- Kubernetes Security Concepts
Install Kubernetes using kubeadm
- Configure Network Plugin Requirements
- Configure Network Plugin Requirements
- Kubeadm Basic Cluster
- Installing Kubeadm
- Join Node to Cluster
- Join Node to Cluster
- Kubeadm Token
- Manage Kubeadm Tokens
- Kubeadm Cluster Upgrade
- Kubeadm Cluster Upgrade
Securing the kube-apiserver
- Configuring the kube-apiserver
- Enable Audit Logging
- Falco
- Deploy Falco to Monitor System Calls
- Enable Pod Security Policies
- Encrypt Data at Rest
- Encryption Configuration
- Benchmark Cluster with Kube-Bench
- Kube-Bench
Securing ETCD
- ETCD Isolation
- ETCD Disaster Recovery
- ETCD Snapshot and Restore
- ETCD Snapshot and Restore
Purge Kubernetes
- Purge Kubeadm
- 3?Purge Kubeadm
Image Scanning
- Container Essentials
- Secure Containers
- Creating a Docker Image
- Scanning with Trivy
- Trivy
- Snyk Security
Manually Installing Kubernetes
- Kubernetes the Alta3 Way
- Deploy Kubernetes the Alta3 Way
- Validate your Kubernetes Installation
- Sonobuoy K8s Validation Test
Kubectl (Optional)
- Kubectl get and sorting
- kubectl get
- kubectl describe
Labels (Optional)
- Labels
- Labels and Selectors
- Annotations
- Insert an Annotation
Securing your Application
- Scan a Running Container
- Tracee
- Security Contexts for Pods
- Understanding Security Contexts
- AppArmor Profiles
- AppArmor
- Isolate Container Kernels
- gVisor
Pod Security
- Pod Security Policies
- Deploy a PSP
- Pod Security Standards
- Enable PSS
Open Policy Agent (OPA)
- Admission Controller
- Create a LimitRange
- Open Policy Agent
- Policy as Code
- Deploy Gatekeeper
User Administration
- Contexts
- Contexts
- Authentication and Authorization
- Role Based Access Control
- Role Based Access Control
- RBAC Distributing Access
- Service Accounts
- Limit Pod Service Accounts
Securing Secrets
- Secrets
- Create and Consume Secrets
- Hashicorp Vault
- Deploy Vault
Securing the Network
- Networking Plugins
- NetworkPolicy
- Deploy a NetworkPolicy
- mTLS
- Linkerd
- mTLS with istio
- istio
Threat Detection
- Active Threat Analysis
- Host Intrusion Detection
- Deploy OSSEC
- Network Intrusion Detection
- Deploy Suricata
- Physical Intrusion Detection
Disaster Recovery
- Harsh Reality of Security
- Deploy a Response Plan
- Kasten K10 Backups
- Deploy K10