Kubernetes and Cloud Native Security Associate (KCSA) 2026

Explore the four c's of cloud native security—code, container, cluster, and cloud—and apply a defense-in-depth approach with encryption, least privilege, audit logs, image scanning, and a web application firewall.

Explore cloud provider and infrastructure security for Kubernetes, focusing on securing the node layer with minimal OS like Bottled Rocket, private subnets, vpn access, and cross-account isolation with GuardDuty guidance.

Understand the shared security responsibility model for cloud environments and managed Kubernetes clusters, distinguishing between cloud provider on control plane security and customer responsibility for configurations, isolation, and workloads.

Explore Kubernetes isolation techniques for soft multi-tenancy, including namespaces and network policies. Learn about quotas, limits, node isolation with taints and tolerations, and access isolation via RBAC.

Explore container sandboxing to shield host kernels from untrusted code by introducing a user-space kernel (gVisor) or micro virtual machines (firecracker/kata), improving isolation in multi-tenant Kubernetes environments.

opt for minimal, hardened docker images instead of base ubuntu or debian, reducing vulnerabilities and improving compliance; alpine-based images and docker hardened images offer lower risk in production.

Master multi-stage builds in Docker to shrink final images and lower security risk. Copy the final binary from the build stage into a slim runtime image like Alpine.

Explore practical multi-stage builds in Docker by comparing single-stage and multi-stage approaches, building Go apps, running containers on port 8080, and reducing image size with Alpine.

Explore CIS benchmarks, their role in securing servers, cloud, and devices, and how standardized step-by-step guidelines unify security across AWS, Kubernetes, Linux, and more.

Explore the CIS benchmarks for Kubernetes, covering control plane and worker node components, RBAC, port security standards, network policies, CNIs, and the shared responsibility model for managed offerings.

Explore Kubernetes architecture by detailing control plane and worker node components—API server, etcd, scheduler, controller manager, kubelet, and kube-proxy—and how they interact in a running cluster.

Explore etcd security fundamentals by securing plain text data in etcd, enabling TLS for encrypted client traffic, and adopting certificate-based authentication to replace weaker username-password methods.

Secure Kubernetes API server by enforcing TLS encryption, client cert authentication to the HCD, and encrypted storage of secrets, while following CIS benchmark guidelines for auditing, RBAC, and admission controls.

Secure the kube controller manager by disabling profiling by default, binding the matrix endpoint and health checks to localhost, and using root-ca-file ca.cert to verify TLS with the API server.

secure the kubescheduler by disabling the profiling interface by default to reduce attack surface, and protect the kubeconfig with strict permissions and localhost binding to limit api access.

Explore how static pods are managed directly by the kubelet without the api server or scheduler, using a pod.yaml in the root static pods folder.

Learn how Kubernetes audit logging records security-relevant events across clusters, including how different audit levels such as metadata, request, and request response capture varying detail for compliance and debugging.

Learn how Linux capabilities enable non-root binaries to perform privileged operations with specific privileges, such as cap net raw for ping, while restricting root privileges to reduce risk.

Learn how security context sets run as user, run as group, and fs group to avoid root access, secure host files, and control volume access in Kubernetes pods.

Configure container capabilities in a Kubernetes pod using the security context, learn default capabilities, add specific ones like cap_net_admin and cap_sys_time, and optionally drop all for security.

Explore the ptrace system call, enabling a tracer to observe and control another process, demonstrated with strace, pid targeting, and error injection, plus enabling sys_ptrace in pod security context.

Understand how privileged pods grant host access to devices and kernel messages, configured via security context with privileged true, and why set capabilities are preferable in production.

Explore how port security standards enforce Kubernetes policies in production namespaces by blocking unauthorized privileged ports. Learn the three profiles—privileged, baseline, and restricted—and how PSA enforces them.

Explore pod security admission modes—enforce, audit, and warning—and per-namespace profiles like privileged or restricted, with a practical demo of mixed modes.

Learn how Kubernetes authenticates users and service accounts using methods like static token files, X.509 client certificates, bootstrap tokens, service account tokens, and OpenID Connect, with no native user accounts.

Explore Kubernetes authorization by examining authentication, always allow, always deny, and RBAC. See how policies and tokens govern access to pods and other resources in practical demos.

Explore how Kubernetes network policies control pod-to-pod traffic, using pod and namespace selectors and IP blocks to restrict ingress and egress, with practical examples and demos.

Explore the structure of Kubernetes network policies, including API version, kind, metadata, and spec with pod selector, policy types, ingress and egress, and from and to semantics.

Explore how rbac in kubernetes controls who can perform actions on resources within a cluster. Bind roles to users, groups, or service accounts via role bindings and cluster role bindings to grant namespace-specific or cluster-wide permissions such as list pods or create secrets.

Explore the HostPath volume by mounting the host's root filesystem into a pod to access worker node logs, configs, and persistent data with a simple manifest and kubectl steps.

Learn how reclaim policies for persistent volumes govern PV fate after PVC deletion. See delete, retain, and default to delete in dynamic provisioning and storage class contexts.

Explore how node authorization confines kubelets to their own node, enabling safe reads of pods, secrets, config maps, and services, with restricted write access.

Understand trust boundaries and data flow in Kubernetes, and secure untrusted networks with TLS, mTLS, certificate-based authentication, RBAC, network policies, and namespace-driven isolation.

Explore how attackers maintain footholds in Kubernetes clusters through persistence techniques such as malicious cron jobs, sidecar injections, static pods, SSH key injection, host path access, and service account tokens.

Explore denial of service and distributed denial of service attacks, how attackers overwhelm servers with floods of traffic, and how CDNs and DDoS protection services mitigate impact.

Explore how a network-attached attacker can disrupt a Kubernetes cluster by targeting control plane and worker components, causing denial of service, broken networking, and degraded monitoring.

Identify how attackers access sensitive data in Kubernetes and cloud-native systems—env variables, image caches, secrets, and config maps—and emphasize never storing secrets in images, plus TLS and RBAC.

Compare soft and hard multi-tenancy in Kubernetes, balancing cost of managed clusters with secure, fair resource sharing using namespaces, rbac, quotas, network policies, and sandbox runtimes.

Secure end-to-end Kubernetes supply chain security by safeguarding git sources, third-party libraries, docker images, and yaml manifests, and implement scanning, signing, and protections like tls and web application firewall.

Explore container image attestations, SBOM, and provenance to understand how images are built and what they contain, with demos of docker scout attestation and related scans.

Explore Falco, an open source runtime security tool that uses configurable rules to alert on host, container, and Kubernetes events, strengthening detection and prevention in cloud native environments.

Explore how a service mesh manages traffic management, observability, reliability, and security for microservices, using sidecar proxies like Envoy to enable MTLS, service discovery, and centralized policies.

Explore Istio, an open-source service mesh for Kubernetes, with a two-plane architecture (control plane and data plane) and sidecar Envoy proxies to manage, secure, and observe traffic.

Explore how admission controllers intercept, validate, and sometimes modify api server requests before persistence, enabling mutating and validating types like namespace auto provision and pod security admission controller.

Explore the basics of AppArmor as a mandatory access control tool that confines processes with predefined profiles, contrasting it with discretionary access control and highlighting enforcement, complain, and unconfined modes.

Explore AppArmor in practice by creating a script, generating a profile with aa-genprof, and enforcing restrictions that block unauthorized actions, even for root.

Integrate AppArmor with Kubernetes by applying AppArmor profiles in pod security context, deploy a HelloAppArmor pod, verify enforcing mode, and handle profile not found errors.

Explore key compliance concepts and security frameworks, including PCI DSS, GDPR, HEPA, and NIST and CIS benchmarks, with audits, hardening practices, and how CIS benchmarks ease regulatory reviews.

Explore NIST 800-53 revision 5, a regulatory framework with 20 control families detailing minimum security controls for federal systems, including access control and supply chain risk management, with practical guidelines.

Explore threat modeling frameworks using the stride model to identify spoofing, tampering, denial of service, and align MITRE ATT&CK techniques with mitigations such as cosign image signing.

Define BOM and SBOM, and show how SBOM lists software components, dependencies, licenses, and risks, using Nginx examples and tools like Trivy and SPDX.

Explore the four-phase cloud-native security lifecycle—develop, distribute, deploy, runtime—and shift-left security with tools for static analysis, IAC and workload scans, image signing, admission controls, and runtime threat detection in Kubernetes.

Explore the OWASP top 10 Kubernetes risks, from insecure workload configurations to supply chain security, including security context, RBAC, network policies, and image signing.

Explore defense in depth across the four C's: cloud, cluster, container, and code layers; know Kubernetes architecture, RBAC, network policies, image signing, PCI DSS, and STRIDE for exams.

Master key KCSA exam pointers on RBAC verbs, reclaim policies, secret mounting methods, Linux namespaces, host network risks, and build attestation concepts such as SBOM and provenance.