Prasanta Kumar Behera
Kubernetes Security & Hardening
Learning Hub / Kubernetes & Platform

Kubernetes Security & Hardening

Advanced15 lessonsAvailable

Production-hardened, identity-integrated clusters. Starts with the PKI that holds Kubernetes together, adds human login through OIDC/SSO/MFA, secures traffic at the edge and inside the cluster, and ends with a hardened cluster built from scratch and checked against CIS.

You'll meetPKIcertificatesOIDCSSO / MFARBACIngressGateway APImTLSNetworkPolicyadmissionsupply chainCIS
Start lesson 01 →

What you'll be able to do

  • Map every certificate in a cluster, and rotate them without an outage
  • Put OIDC login (Keycloak/Dex + kubelogin) with MFA in front of kubectl
  • Terminate and pass through TLS/mTLS with Ingress and the Gateway API
  • Enforce policy and verify supply chain with admission control

Before you start

Kubernetes Administration Level 2, TLS basics.

How it works

Each lesson: plain-language idea → how it really works → hands-on. Each section ends with a cheat sheet & self-check.

Curriculum

Lessons marked “Read” are ready; the rest are on the way.

Identity & Access

  1. 01Cluster PKI & certificatesCluster CA, kubelet serving/client certs, rotation, expiryRead →
  2. 02cert-manager in productionIssuers, ACME, private CA, renewal monitoringRead →
  3. 03Authentication methodsX.509, service account tokens, webhook, OIDCRead →
  4. 04OIDC login for kubectlKeycloak or Dex, kubelogin, group claimsRead →
  5. 05SSO, federation & MFAEnterprise IdP, TOTP/MFA, break-glass accessRead →
  6. 06RBAC design at scalePersonas, aggregation, auditing who can do whatRead →
  7. 📋Cheat sheet & self-checkEvery command from this section on one page, then 19 questions to check yourself.Open →

Traffic Security

  1. 07Ingress controllers & TLSNGINX/Traefik, termination vs passthroughRead →
  2. 08Gateway APIGatewayClass, HTTPRoute, cross-namespace policyRead →
  3. 09Network policies & mTLSDefault-deny, Cilium/Calico policy, workload mTLSRead →
  4. 📋Cheat sheet & self-checkEvery command from this section on one page, then 9 questions to check yourself.Open →

Workload & Supply Chain

  1. 10Pod Security & admission controlPSA levels, Kyverno/Gatekeeper policiesRead →
  2. 11Secrets managementEncryption at rest, KMS, External Secrets, VaultRead →
  3. 12Supply chain securityImage signing (cosign), SBOM, scanning, admission verifyRead →
  4. 📋Cheat sheet & self-checkEvery command from this section on one page, then 9 questions to check yourself.Open →

Detect & Harden

  1. 13Audit logging & runtime detectionAudit policy design, FalcoRead →
  2. 14CIS benchmark hardeningkube-bench, node hardening, SELinuxRead →
  3. 15Capstone: hardened cluster from scratchBuild it, attack it, write the runbookRead →
  4. 📋Cheat sheet & self-checkEvery command from this section on one page, then 8 questions to check yourself.Open →

Real-world scenarios

Work through each one: symptom → misleading signal → evidence → root cause → prevention.

Thousands of certificates, one expiry date

Every kubelet certificate was issued on the same day. Plan the rotation before it becomes an outage.

The CA was rotated and half the clients broke

Trust bundles, leaf certificates and rotation order.

Signed, verified, and still malicious

What signing proves, and what it doesn't.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.