Core Concepts, Threats, and Access
Controls
1. Introduction to Kubernetes Security
- Kubernetes
architecture (brief)
- Shared
responsibility model
- Kubernetes
attack surface overview
2. Kubernetes API & Key Security Features
- API
Server security fundamentals
- Certificates,
TLS, service accounts
- Built-in
security scaffolding (RBAC, Pod Security Standards, NetworkPolicies)
Hands-on Practical Exercises
3. Threat Modeling: How Clusters Get Hacked
- How
attackers find exposed APIs and etcd
- Code
execution inside containers
- Privilege
escalation patterns
- Case
Study
4. Access Control: Authentication &
Authorization
- Users,
service accounts
- Authentication:
certificates, tokens, OIDC
- RBAC
essentials (Roles, RoleBindings, ClusterRoles)
- Admission
control basics
- Hands-on Practical Exercises
5. Managing Secrets & Credentials
- Kubernetes
Secrets basics
- Secret
creation, mounting, and rotation
- Best
practices: external secret stores & KMS integration
- Protecting
credentials within containers
6. Securing API & Node Access
- TLS
enforcement
- Hardening
kubelet
- Limiting
external access to API and etcd
- Disabling
insecure features
7. Workload Hardening Foundations
- Pod
Security Standards (replaces PSP)
- Resource
limits
- Privilege
restriction (capabilities, root control, seccomp)
- NetworkPolicies
introduction
Hands-On Practical Exercises
Hardening, Workload Security, Cloud
Access & Monitoring
8. Securing Workloads in Practice
- Applying
Pod Security Standards
- Node
isolation strategies
- Limiting
container privileges (seccomp/AppArmor)
- Restricting
network communication with NetworkPolicies
9. Securing Container Images & Supply Chain
- Image
best practices
- Vulnerability
scanning
- Image
signing & trust (Cosign, Notary—overview)
- Registry
access control
- Hands-on Practical Exercises
10. Protecting Cluster Components
- Securing
etcd access
- Token
and credential rotation
- Evaluation
of third-party components (operators, controllers)
- Limiting
permissions of add-ons & third-party software
11. Access to Cloud Provider Resources
- Metadata
service risks
- IAM
roles for service accounts (IRSA / workload identity)
- Least-privilege
cloud permissions for Kubernetes workloads
12. Encrypting Data at Rest
- Encryption
of Secrets in etcd
- Storage-level
encryption (EBS, PD, Azure Disk)
- Backup
encryption strategy
- Hands-on Practical Exercises
13. Monitoring & Auditing for Security
- Kubernetes
audit logs
- Logging
best practices
- Supply
chain audit considerations
- Subscribing
to CVEs, updates, and security bulletins
14. Establishing an Organizational Security
Policy
- Security
posture review
- Building
a Kubernetes security model
- Cloud-native
security best practices checklist
- Summary
& final recommendations
- Hands-on Practical Exercises
