Udemy Business

Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Google Kubernetes Engine Security on Google Cloud Platform

A comprehensive guide to securing Google Kubernetes Engine (GKE) using RBAC, network policies, and best practices.

Created byShikhar Verma

Last updated 4/2025

English

What you'll learn

Set Up a K8s Cluster using GKE on Google Cloud Platform - GCP
Learn and Apply RBAC to Secure Kubernetes API Access
Hands-On RBAC: Secure Kubernetes Access with Practical Labs
Configure SSL/TLS Certificates for Kubernetes Client Authentication
Deploy Minikube Kubernetes Cluster on Google Cloud
Explore RBAC Components Like Roles and RoleBindings to Manage Cluster Access
Expand RBAC Permissions to enable users to manage Pods within a specific namespace.
List and Manage Kubernetes Contexts
Access and Work with a Minikube Kubernetes Cluster as a designated user with controlled privileges.
Design and Implement Network Policies to regulate Pod-to-Pod communication securely.
Enforce Pod-to-Pod Communication Restrictions using Network Policies in a hands-on lab session.
Configure Selective Network Policies to allow controlled communication between specific Pods.
Secure an Nginx Server on a Kubernetes cluster using HTTPS (TLS encryption) for enhanced security.
VM Remote Access: Using MobaXterm or PuTTY for Secure Connections

Course content

12 sections • 67 lectures • 3h 2m total length

Introduction1:38
The Kubernetes Cluster Architecture8:23
Learn Architecture Through Examples4:48
Explore how a Kubernetes cluster handles an nginx deployment by stepping through API server, controller manager, scheduler, kubelet, and kube-proxy, illustrating pod creation, IP allocation, and fault recovery.
Getting Started with Kubernetes3:34
Control Plane Components in Kubernetes (Master Node)2:54
Kubernetes Scheduler: A Key Control Plane Component2:13
Kubernetes Controller Manager1:52
The controller manager on the master node ensures the cluster's actual state matches the desired state, using the api server and scheduler to deploy containers.

Introduction3:40
Key components of RBAC3:55
How RBAC works?3:07
How Role and RoleBinding Work Together1:34
Kubernetes Roles: Defining Permissions and Access1:43
Learn how Kubernetes roles define permissions with verbs like get, create, update, and delete, and how role bindings assign these roles to users, groups, or service accounts.
Permissions Granted by Kubernetes Roles2:34
Create a role3:10
Bind the Role to a User or Service Account3:24
Bind a role to a user or service account within a namespace using a role binding, linking a subject to a pre-defined role such as pod-reader via rbac.authorization.k8s.io.

Project Overview2:57
Launch VM for Minikube Cluster2:09
Activate Cloud Shell and Connect to VM1:59
Access your google cloud vm via ssh or cloud shell, authorize ssh keys, and use sudo to elevate privileges; then prepare to configure a minikube cluster in the next lecture.
Minikube Kubernetes Cluster Setup – Practical Lab 12:44
Minikube Kubernetes Cluster Setup – Practical Lab 22:17
Minikube Kubernetes Cluster Setup – Practical Lab 31:00
Start Minikube and Deploy Nginx Pod3:03

Set Up New Namespace & Launch Pod2:44
Overview of Client Certificate Generation3:33
Learn to set up secure client authentication in minikube by generating a private key and a certificate signing request, then signing it with minikube CA to issue a client certificate.
Generate a Private Key1:23
Generate a private RSA key with OpenSSL to enable secure user authentication, saving it as a .key file with a key size in bits, then create a CSR.
Generate a Certificate Signing Request (CSR)1:30
Generate a certificate signing request (CSR) with OpenSSL by using the DevOps.key private key and saving the CSR as DevOps.csr, while setting the subject’s common name and organization.
Sign a CSR with Minikube's CA to Generate a User Certificate3:32
Set and Verify Client Credentials in Kubernetes Config3:06
Configure the Kubernetes credential for the DevOps user by associating the DevOps client certificate and private key with kubectl config set-credentials.

Start Minikube with Cilium CNI5:35
Create Two Pods with Labels2:19
Create two pods named pod-a and pod-b with a lightweight nginx alpine image, then label them f=pod-a and f=pod-b using kubectl.
Verify Pod Connectivity Using Curl2:33
Verify pod connectivity using curl between pod A and pod B in gke with cilium, illustrating default pod-to-pod communication and preparing to apply a network policy to block it.
Create Ingress Network Policy to Restrict Pod Access4:35
Check if Pod-to-Pod Access is Blocked1:44
Block all pod-to-pod communication with a network policy, verify the block from pod A to pod B and back using kubectl and curl.
Restrict Ingress/Egress Traffic with Network Policy2:58
Demonstrate denying all ingress in the default namespace, test pod-to-pod communication, then block egress by editing and reapplying the network policy, and verify with a curl timeout.

Deploy a Virtual Machine1:57
Add User and Setup SSH Authentication2:41
Create SSH Key Pair2:02
Convert Private Key to .ppk Format2:06
Convert a private key to .ppk format using Puttygen to enable SSH access to an Ubuntu VM via Mobaxterm, and configure the private key in the SSH settings.
VM Access Troubleshooting1:45
Troubleshoot vm access by using cloud shell to manage public/private keys and authorized_keys. Connect from external tools like Mobaxterm or Putty via the VM's public IP.
Deploy Minikube on Virtual Machine2:32
Initialize Minikube Cluster1:25
Install kubectl, make it executable, move the binary to the system bin directory, then start a minikube cluster with docker and display version details in yml format.

Requirements

Basic Understanding of Kubernetes
Fundamental Knowledge of Linux Commands
Experience with Kubernetes CLI (kubectl)
Some Exposure to Cloud Platforms like Google Cloud Platform

Description

Understanding Kubernetes: Cluster Components and Architecture

Introduction
The Kubernetes Cluster Architecture
Learn Architecture Through Examples
Getting Started with Kubernetes
Control Plane Components in Kubernetes (Master Node)
Kubernetes Scheduler: A Key Control Plane Component
Kubernetes Controller Manager

Set Up a K8s Cluster on Google Kubernetes Engine (GKE)

Lab 1: Practical Kubernetes Cluster Setup
Lab 2: Practical Kubernetes Cluster Setup
Lab 3: Practical Kubernetes Cluster Setup
Lab 4: Practical Kubernetes Cluster Setup

RBAC Policies for Securing Kubernetes Cluster

Introduction
Key components of RBAC
How RBAC works?
How Role and RoleBinding Work Together
Kubernetes Roles: Defining Permissions and Access
Permissions Granted by Kubernetes Roles
Create a role
Bind the Role to a User or Service Account

Set Up a Minikube Kubernetes Cluster on Google Cloud

Project Overview
Launch VM for Minikube Cluster
Activate Cloud Shell and Connect to VM
Minikube Kubernetes Cluster Setup – Practical Lab 1
Minikube Kubernetes Cluster Setup – Practical Lab 2
Minikube Kubernetes Cluster Setup – Practical Lab 3
Start Minikube and Deploy Nginx Pod

Client Authentication using SSL/TLS Certificate

Set Up New Namespace & Launch Pod
Overview of Client Certificate Generation
Generate a Private Key
Generate a Certificate Signing Request (CSR)
Sign a CSR with Minikube's CA to Generate a User Certificate
Set and Verify Client Credentials in Kubernetes Config

RBAC: Role and RoleBinding

Create a Role
Create RoleBinding to Assign Role to User
Test RBAC Permissions

Access the K8s Minikube Cluster as a User

List and Manage Kubernetes Contexts
Set Up a New Context for a User
Verify RBAC Permissions with New Context
Modify and Test RBAC Role Permissions

Set Up and Verify Network Policies for Pods

Introduction to Kubernetes Network Policies
Why Restrict Pod-To-Pod Communication?
Understanding K8s Network Policies and CNI Plugins
Example Use Case Scenarios

Lab: Restrict Pod Communication Using Network Policies

Start Minikube with Cilium CNI
Create Two Pods with Labels
Verify Pod Connectivity Using Curl
Create Ingress Network Policy to Restrict Pod Access
Check if Pod-to-Pod Access is Blocked
Restrict Ingress/Egress Traffic with Network Policy

VM Remote Access: Using MobaXterm or PuTTY for Secure Connections

Deploy a Virtual Machine
Add User and Setup SSH Authentication
Create SSH Key Pair
Convert Private Key to .ppk Format
VM Access Troubleshooting
Deploy Minikube on Virtual Machine
Initialize Minikube Cluster

Secure Deployment and Access of Nginx on Kubernetes

Overview of Securing Nginx with HTTPS
Deploy and Expose a Nginx Pod to External Traffic
Access Nginx Web Server Through HTTP
Set Up Nginx on Host Machine for Accessing Nginx Pod
Access Nginx Web Server via Web Browser (HTTP Only)

Implement HTTPS for Nginx in a K8s Cluster Using TLS Certificates

Deploy and Expose a Nginx Pod to External Traffic
Generate a self-signed TLS Certificate
Store the TLS Certificate as a Secret
Check Minikube’s Ingress Controller Status
Create Ingress Resource for HTTPS
Last Lecture

Who this course is for:

DevOps Engineers – Looking to implement secure access controls and network policies in Kubernetes environments.
Cloud Engineers and Architects
IT Professionals & Enthusiasts – Anyone interested in learning Kubernetes security best practices.

Google Kubernetes Engine Security on Google Cloud Platform

What you'll learn

Explore related topics

Course content

Understanding Kubernetes: Cluster Components and Architecture7 lectures • 25min

Set Up a K8s Cluster on Google Kubernetes Engine (GKE)4 lectures • 18min

RBAC Policies for Securing Kubernetes Cluster8 lectures • 23min

Set Up a Minikube Kubernetes Cluster on Google Cloud7 lectures • 16min

Client Authentication using SSL/TLS Certificate6 lectures • 16min

RBAC: Role and RoleBinding3 lectures • 7min

Kubernetes Access with Client Certificates and Context Setup4 lectures • 10min

Set Up and Verify Network Policies for Pods4 lectures • 9min

Lab: Restrict Pod Communication Using Network Policies6 lectures • 20min

Securely Access Minikube Cluster Using MobaXterm or PuTTY7 lectures • 14min

Requirements

Description

Who this course is for: