Training Services
At ControlPlane, we take pride in offering a best-practice driven Kubernetes curriculum that features a comprehensive range of instructor-led hands-on labs, practical examples, and real-world scenarios. Our training courses are designed with various skill levels and requirements in mind, drawing on our wealth of experience in deploying and supporting secure, high-compliance, mission-critical distributed systems for some of the world’s most reputable brands.
Each Kubernetes courses cover essential topics such as container orchestration, application deployment, advanced features, security, and debugging techniques. We diligently update all content to reflect the latest Kubernetes release while incorporating valuable community feedback and insights from our enterprise engagements. Our goal is to empower individuals to excel in the ever-evolving world of cloud native technology through expertly crafted training modules.
Kubernetes Fundamentals (2 days)
Brief Description
This course introduces participants to container orchestration with Kubernetes. Attendees will master the foundational concepts of Kubernetes in development and production through a combination of presentations, demos, and hands-on labs, including building and deploying Kubernetes applications, cloud native Continuous Delivery, and cluster monitoring and debugging. This course also covers system components, core resources, and the requirements for minimum viable cluster security.
Course Outline
- What real-world problems does Kubernetes solve?
- Kubernetes in historical context
- Container basics: Linux cgroups and namespaces
- Core resources and kubectl
- Kubernetes system components
- Container networking
- Developer workflow
- Deploying an application: CI pipeline, containerisation, testing, secure configuration, liveness & readiness probes, and useful kubectl tips
- Interactive cluster debugging
Who Should Attend
This course is designed for those who are new to Kubernetes and containers, as well as those who have had exposure but would like to gain a deeper understanding. No prior knowledge of Kubernetes is required. This course is suitable for developers, operations, architects and anyone seeking to gain a strong foundation in modern, cloud native software delivery.
Kubernetes Operations (2 days)
Brief Description
This course builds on Kubernetes Fundamentals by digging deeper into how Kubernetes works. It covers advanced features and use-cases to prepare engineers for the day-to-day reality of creating, maintaining and debugging Kubernetes clusters in production.
Course Outline
- Installing, upgrading, and maintaining Kubernetes
- Cluster architecture and topologies
- Advanced features: networking, storage and ingress
- Zero-downtime deployments and secrets management
- Maintaining etcd
- Enterprise RBAC and authentication
- Testing cluster security
- Interactive production cluster debugging
- Vendor and tooling landscape
- Comparison of cloud-provider Kubernetes offerings
- Self-service, multi-tenant Kubernetes platforms for enterprises
Who Should Attend
This course is designed for anyone with a basic understanding of Kubernetes, and prepares attendees to run production Kubernetes clusters. The course is also suitable for technical managers who want a better understanding of an SRE’s role in cloud native application delivery.
Kubernetes for Developers (2 days)
Brief Description
This course builds on Kubernetes Fundamentals by going “under the hood” and examining the relationship between application workloads and the Kubernetes orchestrator. It details how to take advantage of Kubernetes features to deploy fault-tolerant autoscaling applications, release new versions with zero downtime, and debug failures.
Course Outline
- What’s different about applications in Kubernetes
- How to containerise anything quickly and securely
- Development and test pipelines for containerised applications
- Communicating developer intent to the orchestrator
- How to compose an application in Kubernetes
- Secrets management, identity, and zero trust
- Observability, logging and telemetry for Kubernetes workloads
- Zero-downtime deployment options
- Top-down troubleshooting for each layer of the stack
- Demystifying container networking and cloud native firewalls
- Where, when, and why to persist the application state
- Container security 101
- Interactive production cluster debugging
Who Should Attend
This course is designed for anyone with a basic understanding of Kubernetes and prepares attendees to run write applications for Kubernetes. The course is also suitable for technical managers who want a better understanding of a developer’s changing roles and responsibilities in cloud native application delivery.
Kubernetes and Container Security (1 day)
Brief Description
The course guides attendees through Linux container security in general, and progresses to advanced Kubernetes cluster security. It emphasises pragmatic threat modelling and risk assessment based on an understanding of the tools and primitives available.
Course Outline
- How to attack containerised workloads
- Enhanced container security
- How to attack Kubernetes
- Interactive production cluster hacking
- Hardening Kubernetes
- Locking down applications
- Automated security testing and DevSecOps workflows
- Intrusion detection and breach analysis
- Security tooling and vendor landscape
Who Should Attend
This course is suitable for developers, operations, and security engineers. It covers basic to advanced container and Kubernetes security for those that want to strengthen their security understanding. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, or for established security professionals looking to update their skills for the cloud native world.
Advanced Kubernetes Security: Learn By Hacking (3 days + 1 CTF day)
Brief Description
This comprehensive course, created by Hacking Kubernetes author and SANS instructor Andrew Martin, explores Kubernetes architecture, security, and delivery through offensive and defensive approaches.
From building applications into containers and appraising supply chain vulnerabilities, through runtime detection and monitoring, to evading the system’s defences and popping shells in Kubernetes, this course gives you the tools you need to understand how to attack and defend against present and future threat actors. Attendees will gain hands-on experience building, exploring, and securing real-world systems.
Course Outline
- Container exploitation by example
- Kubernetes attack surface
- Kubernetes deployment pipelines
- Source control signing and verification
- Container image vulnerability scanning
- Circumventing pipeline controls
- Image signing with Cosign and Notary
- Pipeline metadata collection and enforcement
- Supply-chain verification with in-toto and Tekton Chains
- Kubernetes & container security testing
- Secure GitOps deployments with Flux
- Users, identity, and RBAC
- Runtime security and intrusion detection
- Network policy and lockdown
- Service meshes and workload identity
- Advanced container isolation
Who Should Attend
This course is suitable for intermediate to advanced Kubernetes development, operations, and security teams, penetration testers, vulnerability assessors, and hands-on SOC analysts. Operational knowledge of Linux, Docker or Podman is a prerequisite and Kubernetes experience is essential. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, and for established security professionals looking to update their skills for the cloud native world.
Threat Modelling Kubernetes (1 day)
Brief Description
Traditional on-premise systems rely heavily on perimeter and firewall security: Kubernetes and cloud native systems present new threat profiles. Cloud technologies change rapidly as vendors introduce new managed services, and users evolve their usage of an ever-expanding toolset. Kubernetes moves fast and security must keep up with the speed of innovation.
Secure Kubernetes usage requires a thorough understanding of the system, its information assets, and any threats or risks posed by its use. In this course, we introduce modern and lightweight threat modelling. These techniques are designed for evolving cloud systems, to help security and engineering teams increase the security and velocity of system delivery.
Course Outline
- Introduction to the basic principles of threat modelling in a Kubernetes context:
- What are we building?
- Business impact assessments for data
- Data flow diagrams and information flow matrices
- Understanding threat landscapes and adversaries
- Kubernetes technical overview
- Introduction to an example architecture to threat model
- Information flow matrix lab
- What can go wrong?
- Gathering techniques and threat sources
- Modelling techniques
- STRIDE
- Attack Trees
- Building Attack Trees as code
- Key differences between cloud native and on-prem
- Key Kubernetes threats to workloads, storage, networking and the control plane
- STRIDE brainstorming lab
- What are we going to do about that?
- Risk management techniques
- Key Kubernetes security controls
- Lab on selecting proportionate controls
- Did we do a good enough job?
- Iterative threat modelling
- Scaling the threat modelling process
- Testing security controls in a hands-on lab
Who Should Attend
This course is designed for anyone with a basic understanding of Kubernetes and cloud infrastructure who is interested in investigating formal threat modelling in a cloud native context. It is suitable for security architects and developers, and anyone who aspires to become a Security Champion, driving decisions with a sound understanding of the threats in your organisation’s business environment.
GRC Threat Modelling with Cloud Native (1 day)
Brief Description
This course builds on Threat Modelling Kubernetes by diving deeper into how formal threat modelling can be used to prove compliance with GRC requirements. The course is backed by a full generic Kubernetes Threat Model, linked to controls from industry frameworks and standards. It highlights how these controls can be implemented in practice, using popular open source technologies. As such, attendees will leave with the practical knowledge and tools needed to design or audit secure-by-default Kubernetes-based systems, within highly regulated environments.
Course Outline
- Half-day version of “Threat Modelling Kubernetes” to introduce the fundamentals of Threat Modelling
- Attendees will then use the fundamental Threat Modelling techniques learned in the first half of the course to build up a complete, generic Kubernetes Threat Model
- Deep dive into applicable compliance frameworks
- Integration examples of popular open source technology into governance, risk management, and compliance frameworks, and demonstrations of how these technologies can help organisations meet compliance requirements
- Further hands-on scenario-focused threat modelling based on real customer needs and “straw man” architectures presented by attendees to update the initial generic Threat Model
Who Should Attend
This course is designed for audit and regulatory teams that may have had some exposure to Kubernetes, but who are not well acquainted with how to meet strict GRC requirements for rapidly evolving, cloud native systems. By working through a complete Kubernetes Threat Model, fully mapped to key compliance standards, attendees will leave with the confidence needed to run, audit and assure Kubernetes clusters in highly regulated contexts.
Zero Trust Security with SPIFFE and SPIRE (LFS482)
Zero Trust Security is a critical approach in modern cybersecurity, focusing on the belief that an organization should not implicitly trust anything inside or outside its perimeters. Instead, it must verify everything trying to connect to its systems before granting access. This course provides an in-depth understanding of Zero Trust, along with the implementation and management of SPIFFE and SPIRE, essential tools for modern security practices. The course is tailored to address the unique challenges faced by highly regulated organizations in today’s dynamic and elastic environments.
Who Is It For
This course is ideal for IT professionals, security engineers, and system administrators responsible for implementing and managing security in their organization’s infrastructure. It is especially beneficial for those working in highly regulated industries who need to remain updated with the latest security practices. Participants should have a basic understanding of networking concepts, security fundamentals, and familiarity with cloud and microservices architectures.
What You’ll Learn
Participants will learn about the principles and practices of Zero Trust Security, with a focus on its application in cloud and microservice environments. The course covers the installation, configuration, and management of SPIRE, demonstrating its role in securing application-to-application communication when combined with policy decision and enforcement points. It delves into topics such as identity verification, secure service-to-service communication, and authorization in microservice architectures. Additionally, the course addresses the operational aspects of implementing Zero Trust with SPIFFE and SPIRE, ensuring secure and resilient service delivery in a highly regulated space.
What It Prepares You For
This course equips you to design and implement a production-grade Zero Trust platform using SPIFFE and SPIRE. It enables you to address the security challenges of highly dynamic and regulated environments, ensuring secure, interconnected services for business resilience and reliable customer experiences.
To prepare for this course, the free Introduction to Zero Trust (LFS183x) details the fundamentals of Zero Trust, and how open source tools such as SPIFFE and SPIRE can be used to deploy Zero Trust in your architecture.
Learn More
If you are interested in any of these courses or would like to enquire about our other offerings, please get in touch with us here.