1 Prerequisites This skill 1 Unlocked

Skill · Kubernetes · Secure a Kubernetes cluster

Authorize access to the Kubernetes API with RBAC

Decide who can do what on the Kubernetes API: Roles and ClusterRoles, bindings to users or ServiceAccounts, and checking least privilege.

Start lesson 1The Kubernetes domain

• 1 lesson
• ~1 h 25 of reading
• 2 quizzes
• 0 proof lab

The path

Where it comes from, where it leads

What you need to know first, where you stand on this skill, and what it opens next. Your status is computed in your browser, from what you have read and passed.

Before · 1 prerequisite

• Deploy and observe an application on Kubernetes

Recommended before · 1

• Give a workload a minimal identity (ServiceAccount)

This skill, for you

Authorize access to the Kubernetes API with RBAC

Computing

It unlocks · 1 skill

• Connect the Kubernetes API server and Vault to an OIDC identity provider, turn token groups into limited rights and diagnose a denial

Lessons

How to learn it

1 lesson, about ~1 h 25, in program order. Each lesson ends with its quiz.

The program

1 lesson · ~1 h 25

1. 1RBAC Kubernetes (in French)· 85 min

Beyond the lessons

Assess, practise, pass the proof

Reading a lesson confirms nothing. A skill is confirmed by a passed quiz, practised in a guided lab, and put to the test by a challenge or a mission; an imported lab result is not verified by the site.

Assess yourself

2 quizzes

At the end of the lessons: passed at 70%, they confirm the skill.

Practice

2 guided labs

• Grant read-only access to Pods with RBAC
• Take cluster-admin away from a service account, without stopping its work

Proof

No proof

A practical proof is a challenge, a capstone or a declared lab.

Used by the mission “Open an isolated space for a team on a shared cluster”, which has its proof.

Apply it on real infrastructure

• Protéger les Secrets d'un cluster Kubernetes (in French)

Hands-on lessons: their labs count as practice and their quizzes assess you, without being required to acquire it.

Going further

• Aide-mémoire kubectl : syntaxe, options, modèles et pièges (in French)

Reference pages: they support the skill without teaching it, and do not count in your journey.

Around it

Who requires it, who teaches it

Required by

• DevSecOps Engineer
• Platform Engineer
• CKA
• CKAD
• CKS
• KCNA

In red: the certification it prepares for.

Taught by

• Kubernetes (in French)

Same block · Secure a Kubernetes cluster

• Harden a Pod's execution context (securityContext)
• Give a workload a minimal identity (ServiceAccount)
• Make the cluster reject what breaks a security rule
• Confine a container against the host kernel (seccomp, AppArmor)
• Isolate a Pod in a sandboxed runtime (RuntimeClass)
• Harden a cluster's components with the CIS Benchmark
• Trace who acted on the API with the Kubernetes audit log
• Encrypt and authenticate traffic between Pods

×

See in the glossary →