Kubernetes Security: Harden Production Clusters

Kubernetes gives teams speed, but its defaults are not secure. A cluster that runs perfectly can still hand an attacker a path from one compromised pod to full cluster control. This course teaches you how to close those paths on real, production-style clusters. We work through the full lifecycle across the 4 Cs: cloud, cluster, container, and code. You start by mapping the Kubernetes attack surface and threat modeling with MITRE ATT&CK for Containers, then walk through a guided breach so you can watch privilege escalation and container escape happen before you learn to stop them. From there the course is attack-then-harden, section by section. You secure the software supply chain with minimal and distroless images, Trivy scanning, SBOMs, and keyless signing using Sigstore and Cosign. You design least-privilege RBAC and fix ServiceAccount token hygiene. You harden the control plane: the API server, the kubelet, audit logging, and etcd with encryption at rest and mTLS. You enforce workload security with securityContext, the Pod Security Standards, and Pod Security Admission, the built-in replacement for the removed PodSecurityPolicy, then extend it with policy as code in Kyverno and OPA/Gatekeeper. You replace the flat, default-allow network with default-deny NetworkPolicies and see what Cilium and Calico add. Then you move to runtime: detecting container breakouts, crypto-mining, and anomalous behavior with Falco and Tetragon, and responding when an alert fires. Finally you assess cluster posture against the CIS Kubernetes Benchmark with kube-bench, apply the NSA/CISA Kubernetes Hardening Guidance, scan with Kubescape, and finish with a capstone that hardens a vulnerable cluster end to end. Every lab runs on your own disposable test cluster using kind, minikube, or k3s, never a production or third-party environment. The tooling is open source and vendor-neutral, and the materi…