Sachin Chaurasiya
Search articles, labs, tools…

Path 03 · learning path

Secure Kubernetes

Hardening a cluster layer by layer: RBAC, Pod Security, network policy, admission control with Kyverno and GitOps-driven change control.

Parts
3 parts
Total reading time
~34 min to read
Difficulty
intermediate
Start with part 1 See the path ↓

What you will learn

  • Verify each control of a layered checklist with a command, not a tick box
  • Write Kyverno 1.19 validate, mutate and generate policies in CEL and roll them out audit-first
  • Run Argo CD with automated sync, pruning and self-heal, and lock the control plane down
  • Prove least privilege for the service accounts that deploy

Before you start

Knowledge assumed

  • Kubernetes basics: Pods, Deployments, Services, namespaces (the Kubernetes Operations path covers them)
  • kubectl and a Git workflow
  • Builds on Kubernetes Operations

Hands-on environment

  • A disposable cluster (kind is enough)
  • kubectl and Helm
  • A Git repository to hold manifests

Each part names what it needs. Nothing has to be installed before part 1.

The path

3 parts, in order

Each part states what it assumes from the previous one, so you can also jump in where your setup already is.

  1. Part 1 of 3 Start here

    Kubernetes Security Checklist for Production Clusters

    A layered checklist — control plane, workloads, network, secrets, supply chain and runtime — with the manifests and commands to verify each control rather than just tick it.

    Kubernetes intermediate 10 min read
  2. Part 2 of 3

    Kyverno Policies for Kubernetes Security: Validate, Mutate, Generate

    Install Kyverno 1.19, write CEL-based ValidatingPolicy, MutatingPolicy and GeneratingPolicy resources for non-root pods, image tags, allowed registries and default-deny networking, and roll them out audit-first.

    Kubernetes intermediate 15 min read
  3. Part 3 of 3

    GitOps Deployment with Argo CD

    Install Argo CD, model applications and projects, enable automated sync with pruning and self-heal, and lock the control plane down so Git really is the only way to change the cluster.

    CI/CD intermediate 9 min read

Practise

Labs that exercise this path

All labs →
Lab

Enforce Pod Security with Pod Security Admission and Kyverno

On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.

intermediate 45 minutes Kubernetes · Kyverno
Lab

Least-Privilege Kubernetes RBAC for a Deployer Service Account

Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.

intermediate 35 minutes Kubernetes

Toolchain

Tool profiles used in this path

All tools →
deploy Orchestration

Kubernetes

Container orchestration platform and the deployment target for most of the toolchain.

protect Admission policy

Kyverno

Kubernetes-native policy engine: validate, mutate, generate and verify images with YAML.

deploy GitOps delivery

Argo CD

Declarative GitOps continuous delivery controller for Kubernetes.

deploy Kubernetes packaging

Helm

Package manager for Kubernetes: templated charts with versioned releases.

After the last part

Where to go next

One path picks up where this one stops. It is a suggestion, not a requirement.