>_SecOpsLog_
All courses

Kubernetes attack & defense

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test
Start course
01

Threat model & ATT&CK

3 lessonsTest yourself
01The cluster attack surfaceExposed API/kubelet/etcd, IMDS, and blast radius.30 min02ATT&CK for KubernetesThe adversary playbook and coverage mapping.30 min03Threat-modeling a clusterTrace pivots, control each hop, rank by blast radius.30 min
02

RBAC & privilege escalation

3 lessonsTest yourself
01RBAC & the powerful grantssecrets, pods create, exec — escalation in disguise.35 min02Service-account tokensBound tokens, automount off, minimal reach.30 min03Privilege escalation pathsescalate, bind, impersonate, and the pod path.35 min
03

Admission control internals

3 lessonsTest yourself
01Admission control internalsThe pipeline, webhook order, and enforcement.35 min02PSA, Kyverno & GatekeeperThe pod-hardening floor plus custom policy.30 min03Webhook security & bypassesfailurePolicy, exclusions, and the webhook as target.30 min
04

Control plane & operators

3 lessonsTest yourself
01Control plane & etcdEncrypt secrets at rest, lock the API server, guard the CA.35 min02Node & kubelet securityPod→node blast radius, isolation, metadata blocking.30 min03Operator & controller securityPrivileged automation as a supply-chain dependency.35 min
05

Attack, detect & respond

3 lessonsTest yourself
01Lateral movementThe pivot chain and default-deny east-west.30 min02Detecting cluster attacksAudit log, runtime rules, honeytokens.35 min03Kubernetes incident responseCut identity, preserve, hunt persistence, trust.35 min
Final exam
Test yourself on everything
60 questions drawn from all 5 sections — every answer explained as you pick.
Start final exam