Cloud Native Security

Kubernetes hardening, container escape, supply chain, runtime defense

A focused track on securing modern container-orchestrated workloads — Kubernetes, container images, service meshes, and the supply chain that produces them. The application-layer counterpart to AYSEC-105 (Cloud Security). Audit clusters for the OWASP Container Top 10, deploy admission controllers (OPA Gatekeeper, Kyverno), prevent container escape and pod-to-host attacks, instrument SLSA-grade build pipelines, run runtime security with Falco/Cilium.

Lessons

• Container Fundamentals
• Kubernetes Architecture and Threat Model
• Pod Security: securityContext, AppArmor, seccomp
• Network Policies and Service Mesh Authorization
• Admission Control and Policy Engines
• Supply Chain: SBOM, SLSA, Signed Images, Provenance
• Runtime Detection: Falco, Cilium Tetragon, eBPF
• Capstone: Harden a Vulnerable Cluster