Course Title: dgt_k8s07 – Security
Description:
The “dgt_k8s07 – Security” course covers how to harden Kubernetes (K8s) deployments against current threats and how to verify that they really are hardened. It covers security best practices, tools, and methodologies specific to Kubernetes ecosystems.
Security is where the natural-language approach demands the most rigor. After studying how RBAC, network policies, syscalls and image layers actually work, you ask the AI agent to lock down a namespace, restrict pod-to-pod traffic or scan an image, stating clearly what must remain reachable and what must not. Then you read the policies and rules it generates line by line, test them against the attack paths you know, and push back whenever a manifest is more permissive than it claims to be.
Key Learning Objectives:
-
Understanding Kubernetes Security Fundamentals: Learn core concepts such as network segmentation, identity management, and access controls within Kubernetes clusters.
-
Network Security with Calico and eBPF: Learn how Calico’s network policies strengthen security in a K8s environment, and explore the capabilities of eBPF (extended Berkeley Packet Filter) for high-performance networking and more granular security enforcement. You will describe the intended traffic rules to the machine and check that the resulting policies enforce exactly those rules.
-
Runtime Security with Falco: Learn how Falco, a runtime security tool, detects anomalous behavior by monitoring system calls and other events within your Kubernetes workloads. You will have the agent install it and write rules from your description, then trigger suspicious behavior to confirm that the alerts fire.
-
Kubernetes NetworkPolicy Implementation: Understand how NetworkPolicies control traffic between pods and external services, and learn to specify them in natural language precisely enough that the machine’s output minimizes attack vectors, then verify connectivity yourself.
-
Container Image Scanning with Trivy: Instruct the machine to add Trivy vulnerability scans to your CI/CD pipeline, then interpret the reports it returns, telling real risks apart from noise and identifying known vulnerabilities (CVEs) before they reach production.
-
DevSecOps Practices: Integrate security into the DevOps cycle through a DevSecOps approach, ensuring that security is an inherent part of every stage of the software development lifecycle.
-
Identifying CVE Vulnerabilities Early with CI/CD Integration: Learn strategies for detecting and addressing Common Vulnerabilities and Exposures (CVEs) early in the Continuous Integration/Continuous Deployment pipeline, and for reviewing the gates the machine sets up so that they actually block potential exploits.
Target Audience:
- DevOps Engineers
- Kubernetes Administrators
- Security Specialists
- Software Developers working on security in Kubernetes environments
By the end of this course, participants will understand how security protocols work in Kubernetes clusters and will be able to have them implemented and maintained through natural-language instructions, auditing every result. The course is suitable both for people with existing Kubernetes security experience and for those starting out in the field.
The students can push their exercises to the Academy DevOps & SRE Git project. For this module, create a folder with your username as its name in the following subfolder: https://github.com/Garanti-Del-Talento/gdt_academy/tree/main/dgt_k8s07__security