Skip to content

Zero-trust & workload identity

Zero trust for workloads, built on cryptographic identity: the zero-trust model and why the perimeter fails, SPIFFE/SPIRE workload identity and attestation, service-mesh mTLS at scale (Istio/Linkerd), identity-based authorization, and federation and egress across trust domains. Assumes solid Kubernetes and networking fundamentals.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

Zero-trust foundations

3 lessonsTest yourself

01The zero-trust modelNever trust, always verify; assume breach.30 min 02Workload identity, not IPCryptographic identity that follows the workload.30 min 03Why the perimeter failsFlat interiors, no clean edge, ephemeral workloads.25 min

02

SPIFFE & SPIRE

3 lessonsTest yourself

01SPIFFE IDs & SVIDsTrust domains, X.509 vs JWT identity documents.35 min 02SPIRE & attestationNode + workload attestation, the Workload API.35 min 03SVIDs & rotationX.509 for mTLS, JWT for requests, short lifetimes.30 min

03

Service mesh & mTLS

3 lessonsTest yourself

01Service mesh architectureSidecar vs ambient; what the mesh enforces.30 min 02mTLS at scaleSTRICT mode and the PERMISSIVE migration path.35 min 03The mesh CA & trust chainIssuance, custom roots, protecting signing keys.30 min

04

Identity-based authorization

3 lessonsTest yourself

01Identity-based authzAuthorizationPolicy, default-deny, least privilege.35 min 02Request-level auth (JWT)Validate tokens; authorize on verified claims.30 min 03Policy as code & rolloutVersion, review, audit→enforce the call graph.25 min

05

Federation & egress

3 lessonsTest yourself

01Trust-domain federationExchange bundles; multi-cluster, multi-cloud, B2B.30 min 02Egress & east-west controlAuthorize outbound through an egress gateway.30 min 03Continuous verificationShort-lived trust, posture, per-request checks.30 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam