Hands-on course
Container & Kubernetes Security
Intensive Introduction to Security Aspects of Kubernetes and Container Environments, including Best Practices and Overview of Potential Threats.
Overview
In this course, participants will learn the fundamentals of security in Kubernetes and Container environments, and how to protect their applications and infrastructures from potential threats.
What you will achieve
After the course, participants will be able to apply Best Practices for securing their applications and infrastructures in Kubernetes and Container environments.
Who it is for
The course is aimed at Software, DevOps, and System Engineers or Architects who already have basic knowledge in orchestrating containers with Kubernetes.
Course format
The course is well structured and consists of theoretical explanations and practical exercises. You will be accompanied by an experienced trainer who can answer questions related to Kubernetes & Container Security.
Requirements
- Basic understanding of Kubernetes and Container Orchestration.
- Familiarity with kubectl (apply, get, describe, delete, logs, exec).
- Basic knowledge of Linux and the command line.
Course content
The course guides participants through the following topics. Depending on the questions and interests of the participants, focus areas will be emphasized and ad-hoc topics added:
- Introduction to Container and Kubernetes Security:
- Security challenges and strategies
- Overview of security architecture and tools
- Container Image Security:
- Secure Base Images and Image Scanning
- Integrity and Trustworthiness of Images
- Minimization of Image Size and Attack Surface
- Hardening Container Images
- Network Security in Kubernetes:
- Isolation of Namespaces and Network Resources
- Network Policies and Ingress/Egress Rules
- Brief Overview of Service Mesh and mTLS (with Cilium)
- Security Considerations for Ingress
- Introduction to Gateway API
- Kubernetes API and Authentication:
- RBAC (Role-Based Access Control)
- API Security and Auditing
- Secrets Management and Encryption
- Pod Security and Resource Limitations:
- Pod Security Admission Controller
- Container Runtime Security
- Resource Quotas and LimitRanges
- Security Mechanisms with gVisor
- Monitoring and Logging for Security Incidents:
- Overview of Tools and Techniques
- Monitoring with Falco
- Automation of Security Checks in CI/CD Pipelines:
- Integrating Security Checks into Development Cycle
- Using Tools like Trivy and kube-bench
- Signing and Verifying Container Images with Sigstore Cosign
- Policy Enforcement:
- Using Gatekeeper/OPA and Kyverno for Policy Enforcement
- Mini "Capture The Flag" Example:
- Hands-on exercises to reinforce security knowledge
You will not only get to know these concepts, but also implement them in practice.
Frequently asked questions
- What will I learn in this course?
- You will learn container image security, network security (network policies, mTLS), RBAC and API security, pod security, monitoring with Falco, security checks in CI/CD (Trivy, kube-bench, Cosign) and policy enforcement with OPA/Kyverno.
- Who is this course for?
- For software, DevOps and system engineers or architects who already have basic knowledge of orchestrating containers with Kubernetes.
- What are the prerequisites?
- A basic understanding of Kubernetes and container orchestration, handling kubectl and basic knowledge of Linux and the command line.
- Can the course be booked in-house?
- Yes, we run tailored courses for your team - on-site, remotely or in our course rooms.
Bring this course to your team
In-house & on-demand training
We run this course on-site with your team, remotely, or in our course rooms — tailored to your stack and scheduled on demand. No public dates: talk to us and we build the right programme for you.