Specially curated workshop for corporate teams

Day 1:

Module 1: Basics of Kubernetes

• Definition
• Cluster Structure
• Adoption

‍

Module 2: Introduction to Containers

• Building & Running Containers
• New Container Capabilities

‍

Module 3: Overview & Architecture of Kubernetes

‍

Hands-On Labs Session

‍

Q&A

‍

Day 2:

Module 4: Setup Kubernetes

‍

Module 5: Understanding Kubernetes Concepts

• Pods
• Deployment
• Statefulset

‍

Module 6: Working with services in Kubernetes

‍

Module 7: Review

‍

Hands-On Labs Session

‍

Q&A

Day 1:

Module 1: Creating a Kubernetes cluster for Helm and GitOps

‍

Module 2: Introduction to Helm (theory)

‍

Module 3: Helm configuration and setup

‍

Module 4: Installing Helm Charts

‍

Module 5: Managing your applications with Helm

‍

Module 6: Using templates to define applications and control releases

‍

Q&A/Hands-On Lab Session

‍

Day 2:

Module 7: Setup your cluster for Flux and ArgoCD

‍

Module 8: Introduction to GitOps (theory)

‍

Module 9: GitOps architecture and tooling

‍

Module 10: ArgoCD

‍

Module 11: Flux

‍

Q&A/Hands-On Lab Session

‍

Day 3:

Module 12: Monitoring and observability for GitOps

‍

Module 13: GitOps and Helm

‍

Module 14: Deploying a GitOps solution

‍

Q&A/Hands-On Lab Session

Day 1:

Module 1: Why CKA

‍

Module 2: CKA vs CKAD

‍

Module 3: 

• Home lab 
• Server at home
• VMs on your computer
• Raspberry Pi
• Cloud servers

‍

Module 4: Cluster architecture

‍

Module 5: Cluster design and configuration

‍

Module 6: Deployments and Pods

• Deployments vs pods
• Multi-container pods (sidecars)
• Q&A/Hands-On Lab Session

‍

Module 7: Stateful applications

• Deployments vs statefulsets
• Q&A/Hands-On Lab Session

‍

Module 8: Storage

‍

Module 9: Troubleshooting

‍

Module 10: Workloads

‍

Module 11: Scheduling

‍

Day 2:

Module 12: Kubeadm

‍

Module 13: Networking

• Networking add-ons and frameworks
• CoreDNS
• Kubernetes Services

• ClusterIP
• NodePort
• Load Balancer

• Pod to pod communication
• Service to service communication
• Ingress
• Service Mesh

‍

Module 14: Monitoring and Logging

• Kubernetes dashboard
• Prometheus and grafana
• Cloud monitoring solutions

‍

Module 15: Security

• Cluster security
• RBAC

• Cluster roles
• Role bindings
• Roles
• Users, service accounts, and groups

• Q&A/Hands-On Lab Session

‍

Day 3:

Module 16: Real-world scenarios

• Control plane and worker node planning
• Where will ETCD be deployed
• Cluster upgrades
• Scaling and high availability
• Rolling Updates for pods
• Draining nodes

‍

Module 17: Certification tips

• KodeKloud course and labs
• Killer.sh
• Kubernetes.io docs
• Create an alias for the commands
• Kubernetes cheat sheet

‍

Module 18: Mock tests

‍

Q&A/Hands-On Lab Session

Day 1:

Module 1: Introduction & Overview

• Course Objectives
• Details about the CKAD Certification
• Introduction to Kubernetes and Recap of the Core Concepts from the Beginners Course

Q&A/Hands-On Lab Session

‍

Module 2: 

• Deep Dive into Kubernetes Architecture
• Understanding PODs: Creation and Configuration
• Multi-container pod designs

Q&A/Hands-On Lab Session

‍

Module 3: Configuration

• ConfigMaps, SecurityContexts, Resource Requirements
• Limits and quotas
• Admission controls, RBAC and authorization
• Secrets and Service Accounts

• Creating and using Secrets
• Service Accounts and usage

Q&A/Hands-On Lab Session

‍

Module 4: Health of Labs

• Understanding Readiness and Liveness Probes
• Health Checks

Q&A/Hands-On Lab Session

‍

Day 2:

Module 5: Labels & Selectors

• Working with labels and selectors 
• Selecting resources based on labels

‍

Module 6: Updates

• Rolling updates and Rollbacks in Deployments

• Deployment strategies (blue-green, Canary etc)
• Rolling updates
• Rollback to a version 

Q&A/Hands-On Lab Session

‍

Module 7: Jobs and CronJobs

• Understanding Jobs and CronJobs
• How to Schedule Jobs and CronJobs

‍

Module 8: Services and Network Policies

• Services: exposing applications to the network 
• Network Policies: controlling network traffic
• Ingress 

Q&A/Hands-On Lab Session

‍

Day 1:

Module 9: Storage

• Persistent Volumes and Claims

• Storage Classes
• PV and PVC

Q&A/Hands-On Lab Session

‍

Module 10: Containers and Helm

• Container Image Build and Best Practices 
• Helm/ CRUD/ Deployment strategies 

• Using Helm to deploy existing packages
• Helm deployment strategies

Q&A/Hands-On Lab Session

‍

Module 11: Observability and Maintenance

• Logging in Kubernetes
• Using container logs
• Debugging using container logs

‍

Module 12: Exam Preparation

• Review of all topics
• Mock Exams
• Lightning Labs

‍

Q&A/Hands-On Lab Session

Day 1:

Module 1: Course Overview and CKS Journey

• Details about the CKS Certification (Pre-requisites)

‍

Module 2: Grasping the Kubernetes Attack Surface

• Hacking demo into services on a Kubernetes cluster
  - Scenario introduction & Hacking Demonstration (environment, setup, technology stack)
• Understanding the 4C’s of Cloud Native Security: Cloud, Clusters, Containers, and Code

Q&A/Hands-On Lab Session

‍

Module 3: Cluster Setup and Hardening

• Exploring CIS Benchmarks

• Deep Dive into Authentication, Authorization, and Service Accounts in Kubernetes
  - Kubernetes auth mechanism 
  - Configure kube api-server auth 
  - RBAC (role, clusterRole, roleBinding, clusterRoleBinding)
  - Service account (create, get, describe)
  - Service account secret token

• Ensuring Protection of Node Metadata, Endpoints, and Platform Binaries
• Securing Kubernetes Dashboard
• Network Policies and Securing Ingress Controllers
  - The Network Policy resource (policyType, ingress, egress, from, to)
  - Default netpol 

Q&A/Hands-On Lab Session

‍

Day 2:

Module 4: System Hardening

• Minimizing Host OS Footprint and Limiting Node Access
  - Limit Node Access using usermod, userdel
  - Provisioning Nodes in private network
  - VPN Solutions, Network firewall 
  - Principle of least privilege

• SSH Hardening Techniques
  - SSH overview
  - SSH key pair (public, private, how to generate key pair)
  - Use ssh-copy-id
  - Harden SSH service (updating SSH configuration)

• Understanding Privilege Escalation in Linux and Package Restriction
  - Install only required packages
  - Identify & remove unwanted service 
  - Sudo command, root user
  - View & understand sudoers file in Linux
• Importance of Minimizing Roles and Access in Cloud Environments
• Configuring Firewalls and Restricting Syscalls
  - `strace` command 
  - Restricting syscall using SECCOMP profile 
  - SECCOMP whitelist, blacklist
  - Configure pod to use SECCOMP profile

‍

Q&A/Hands-On Lab Session

‍

Module 5: Minimizing Microservices Vulnerabilities

• Deep Dive into Admission Controllers
  - What is it and the types of A/C.
  - Built-in Kubernetes A/C
  - A/C in the API request life-cycle
  - How to enable/disable A/C

• Understanding and Deploying Open Policy Agent (OPA)
• Management of Kubernetes Secrets
  - Creating Secret in Kubernetes (imperative & declarative) 
  - Encode/decode Secret 
  - Configure secret in pod (env, envFrom)
  - Kubernetes Secret best practices
• Exploring Container Runtime Sandboxes
  - Container sandboxing introduction (VM, container isolation issue) 
  - Seccomp profile, AppArmor 

• Implementing Pod to Pod Encryption with mTLS
  - Issue with unencrypted pod to pod communication
  - Mutual TLS (mTLS) between pods 
  - 3rd party introduction: Istio, Linkerd 

‍Q&A/Hands-On Lab Session

‍

Day 3:

Module 6: Supply Chain Security

• Importance of Minimizing Footprint of Base Images
  - Base vs parent image 
  - Choosing right base image
  - Slim/minimal image
  - Image vulnerability scan

• Understanding Image Security and Supply Chain Security
• Analyzing Workloads and Exploring Supported Tools
• Scanning Images for Known Vulnerabilities

Q&A/Hands-On Lab Session

‍

Module 7: Monitoring, Logging, and Runtime Security

• Behavioral Analytics of Syscall Process & File Activities
  - Analyze Syscall and filter suspicious events
  - Example of common use cases

• Using Tools Like Falco for Defense in Depth
  - Overview & Installation 
  - Use Falco to Detect Threats/Rules

• Detecting Threats within Infrastructure, Apps, Networks, Data, Users, and Workloads
• Ensuring Immutability of Containers at Runtime
• Utilizing Audit Logs for Access Monitoring

Q&A/Hands-On Lab Session

‍

Module 8: Exam Preparation

• Mock Exams and Review