Linux Foundation Kubernetes and Cloud Native Security Associate

A cluster inherits the strengths and flaws of the machines and cloud account beneath it. You look at node and host protection, provider identity and network settings, and the metadata services attackers like to reach.

• Securing hosts and the operating system under nodes
• Cloud account roles and the permissions nodes carry
• Network exposure of nodes and control planes
• Instance metadata and why access to it is risky
• Storage and backup protection

You build A checklist of infrastructure questions to ask before trusting a cluster.

The control plane holds the cluster’s authority. You learn how the API server, controller manager, scheduler and etcd authenticate each other, which settings expose them, and why etcd deserves special protection.

• The API server and its request path
• Controller manager and scheduler credentials
• etcd: contents, access and encryption
• TLS between control plane components
• Ports and flags that widen exposure

You build A table of control plane components, the data each holds and how each is protected.

Every workload ends up on a node. You learn how the kubelet, container runtime and kube-proxy are exposed, what a pod can reach on its host, and how storage and networking attach to pods.

• The kubelet: API, authentication and authorization
• Container runtimes and their sockets
• kube-proxy and node networking
• What a pod shares with its host
• Storage plugins and volume permissions

You build A node-level threat sketch listing what an attacker gains from each exposed component.

Every request to the API passes three gates. You learn how clients prove who they are, how RBAC decides what they may do, and how admission controllers can change or refuse a request.

• Users, groups and service accounts
• Tokens, certificates and OpenID Connect in outline
• RBAC roles and bindings
• Admission: mutating and validating
• Reading an RBAC policy for excess privilege

You build A walk-through of one API request through authentication, authorization and admission, with the decision at each gate.

Workloads need rules about what they can do and whom they can talk to. You learn the Pod Security Standards, how secrets are stored and exposed, and how network policy and namespaces divide a cluster.

• Privileged, baseline and restricted pod profiles
• Security contexts in plain terms
• Secrets: storage, access and encryption at rest
• Namespaces and network policy as segmentation
• The limits of multi-tenancy

You build A one-page standard for how a team’s pods should be configured, secrets handled and namespaces separated.

You cannot respond to what you cannot see. You learn what Kubernetes audit logs record, how monitoring and observability tools reveal abnormal behavior, and what a useful security signal looks like.

• What the API server audit log records
• Audit policy levels in outline
• Logs, metrics and events as security signals
• Spotting abnormal behavior
• Where signals should be sent and kept

You build A short list of security events to watch in a cluster, with the log source for each.

A cluster runs whatever it is given. You learn how image security, repositories and the supply chain interact, why provenance matters, and which checks stand between source code and a running pod.

• Image contents, base images and vulnerabilities
• Registries, access and image pull secrets
• The stages of a software supply chain
• Signing, provenance and bills of materials in outline
• Code security: dependencies and static checks

You build A supply chain diagram for one application, marking where an attack could enter and the check that answers it.

Attackers think in boundaries and paths. You study the trust boundaries and data flows of a cluster, then follow the common attacks: a compromised container, a network attacker, privilege escalation, persistence and denial of service.

• Trust boundaries and data flows
• A compromised container and what it can reach
• Network attackers and exposed services
• Privilege escalation and persistence
• Denial of service against shared components
• Where sensitive data lives and how it leaks

You build A threat model for one cluster that traces three attack paths from entry to impact.

Platform tools add security features of their own. You learn how a service mesh secures service traffic, how public key infrastructure issues and rotates certificates, and how admission policy enforces rules at the door.

• Service mesh and mutual TLS in outline
• PKI in a cluster: certificate authorities and rotation
• Connectivity and ingress protection
• Admission controllers and policy engines
• Choosing which platform controls to add

You build A comparison of two platform controls for one risk, with the trade-offs written out.

Security work has to be shown, not just done. You learn how compliance frameworks and threat modeling methods apply to clusters, how supply chain standards help, and where automation keeps evidence current.

• Common compliance frameworks and what they ask for
• Benchmarks and hardening guides
• Threat modeling methods such as STRIDE
• Supply chain compliance and attestations
• Automating checks and collecting evidence

You build A mapping from three security requirements to the cluster controls and tools that meet them.

Review a sample cluster layer by layer. You identify what is exposed, describe the risks in plain terms, recommend controls from across the course, and present findings to a team that has to act on them.

• Scoping the review and gathering facts
• Walking the four layers in order
• Tracing attack paths against the controls
• Writing findings a team can act on
• Presenting the review and answering questions

You build A written security review of a sample cluster, with findings, risks and recommended controls.