Skip to content

Kubernetes attack & defense

Kubernetes security from both sides: the cluster attack surface and MITRE ATT&CK for Containers, RBAC and the privilege-escalation primitives, admission-control internals and their bypasses, control-plane/etcd/operator security, and lateral movement with detection and a cluster incident-response runbook. Assumes the CKS-level course.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

Threat model & ATT&CK

3 lessonsTest yourself

01The cluster attack surfaceExposed API/kubelet/etcd, IMDS, and blast radius.30 min 02ATT&CK for KubernetesThe adversary playbook and coverage mapping.30 min 03Threat-modeling a clusterTrace pivots, control each hop, rank by blast radius.30 min

02

RBAC & privilege escalation

3 lessonsTest yourself

01RBAC & the powerful grantssecrets, pods create, exec — escalation in disguise.35 min 02Service-account tokensBound tokens, automount off, minimal reach.30 min 03Privilege escalation pathsescalate, bind, impersonate, and the pod path.35 min

03

Admission control internals

3 lessonsTest yourself

01Admission control internalsThe pipeline, webhook order, and enforcement.35 min 02PSA, Kyverno & GatekeeperThe pod-hardening floor plus custom policy.30 min 03Webhook security & bypassesfailurePolicy, exclusions, and the webhook as target.30 min

04

Control plane & operators

3 lessonsTest yourself

01Control plane & etcdEncrypt secrets at rest, lock the API server, guard the CA.35 min 02Node & kubelet securityPod→node blast radius, isolation, metadata blocking.30 min 03Operator & controller securityPrivileged automation as a supply-chain dependency.35 min

05

Attack, detect & respond

3 lessonsTest yourself

01Lateral movementThe pivot chain and default-deny east-west.30 min 02Detecting cluster attacksAudit log, runtime rules, honeytokens.35 min 03Kubernetes incident responseCut identity, preserve, hunt persistence, trust.35 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam