Kubernetes Security

As a Kubernetes team, you practise risk assessment and access control through KCSA preparation. Experienced cluster admins practise hardening and incident analysis in CKS preparation after passing CKA; CKA preparation is then unnecessary. Specialisations add configuration rules, runtime detection, network protection and secrets.

Your starting point in 3 questionsView route, duration & prices

THE LEARNING PATH AT A GLANCE

Kubernetes Security: stages, scope and sequence

The route spans 5 stages, from “Prior knowledge” to “Role focus”. Workshop counts, training days and price refer to the core route.

  • 5 workshops · Core route
  • 16 training days · Core route
  • €8,880 excluding VAT · Core route

  1. Prior knowledge

    Existing experience can replace individual stations.

  2. Container foundation

    Either container foundation leads into the shared Kubernetes basics.

  3. Kubernetes basics

    Practical foundations for later role responsibilities and certification goals involving hands-on exams.

  4. Operations practice

    You deepen workload practice, scaling, access and network rules, operational signals and configuration per environment.

  5. Role focus

    This learning path follows a role path, which optional topics deepen.

Your route through this path

YOUR LEARNING PATH

The experience you bring

Check which learning steps you still need.

Find your starting point: 3 questions

TEAM ROUTE: OPTIONAL

Plan a shared training programme

Roles → skill gaps → shared plan

The result: a clear route for the whole team.

Your self-assessment

For each question, choose the answer that best describes your current situation.

Recommendation without contact details or sign-up

Goal set by this learning path

Skills, sequence, workshops

Which Kubernetes skills build on each other?

The learning steps show this path’s recommended sequence. Depending on your goal, they include specialisations, optional topics or certification goals. Each step shows the workshops that cover it.

How to read the learning path
  • Required or recommended
  • Choice
  • Optional further study
  • Further learning path

Preparation

Before starting, if needed; excluded from the workshop count, days and price.

Show 5 skills

  • Prior knowledge

    Existing experience can replace individual stations.

    • PRIOR KNOWLEDGEOptionalIF NEEDED
      Linux and network access

      Command line, processes, file system, connectivity, ports, SSH access

      You practise Linux commands, processes and file permissions, check network interfaces, connectivity and open ports, and connect to remote computers using SSH. The Linux workshop helps fill knowledge gaps; the Docker and Podman workshops introduce YAML as a configuration format.

      Afterwards, you can inspect files, permissions and processes in a Linux terminal, narrow down network problems and work on remote computers using SSH.

      If you lack Linux practice, practise using the shell, processes and file system for entry into Kubernetes and KCSA preparation. CKS preparation additionally requires advanced Linux skills and network security fundamentals.

      4 learning moves

      1. Navigate the file system

        You use shell commands to navigate directories and search file contents, so you can find your way around a Linux system.

      2. Check permissions and processes

        You check file permissions and running processes to understand access boundaries and stop unresponsive processes selectively.

      3. Examine network access

        You check network interfaces, connectivity and open ports separately to narrow down connection problems.

      4. Access remote computers with SSH

        You connect to a remote computer using SSH to apply your terminal skills on another system.

      • Prerequisite: The “Kubernetes basics” competency requires Linux and terminal fundamentals; if you already have this knowledge, you do not need the Linux workshop.
    • PRIOR KNOWLEDGEOptionalIF NEEDED
      Git and collaboration

      Commits, branches, merges, remotes, reviews

      You version changes with Git and practise collaboration through branches and reviews. Choose the Git introduction or the workshop using GitLab as its platform.

      Afterwards, you can version changes with Git, share them through branches and remotes, merge them after review and resolve merge conflicts.

      You practise recording changes with commits, working on separate branches and checking changes in reviews. This preparation with Git or GitLab provides the branch practice required by the policy workshops.

      4 learning moves

      1. Record changes as commits

        You trace changes from the working directory through the staging area to a commit, so you can choose what to version.

      2. Separate work with branches

        You work on changes separately in branches and compare them before bringing the work back together.

      3. Exchange changes through remotes

        You share commits through remote repositories and distinguish fetching other people's changes from integrating them.

      4. Review and merge changes

        In reviews, you discuss changes through their differences and resolve merge conflicts to combine contributions with team input.

      Choose 1 of 2

      Choose the Git workshop to start, or the GitLab workshop if your team uses GitLab.

      • Prerequisite: Working on GitLab pipelines requires Git fundamentals; existing experience can replace the introductory workshop.
      • Prerequisite: The policy workshops require experience with Git branches; existing experience is sufficient.

  • Container foundation

    Either container foundation leads into the shared Kubernetes basics.

    Choose 1 of 2

    Choose Podman if your team or target platform uses it or containers must run without root privileges; otherwise choose Docker.

    • CONTAINEROptionalCHOICE
      Docker fundamentals

      Images, containers, volumes, networks

      You build container images with Dockerfiles, including multi-stage builds, and run containers with persistent storage and network connections. With Docker Compose, you run related application services.

      Afterwards, you can build custom images, connect containers with persistent storage and run related application services with Docker Compose.

      You examine how container images are built from layers and base images, and work with registries as image stores. This preparation lays the foundation for later vulnerability scanning and image signing.

      4 learning moves

      1. Distinguish images from containers

        You start containers from images and inspect their state to distinguish the template from the running application.

      2. Build custom images

        When building images, you separate build stages from runtime contents so that build tools need not remain in the final image.

      3. Connect storage and networks

        You use volumes to retain data across container restarts and connect containers through networks so they can exchange data.

      4. Combine services with Compose

        In Docker Compose, you describe services, storage and networks with YAML and check how they work together in an application.

      • Recommended next step: Container experience helps with the Kubernetes introduction but is not a prerequisite for the fundamentals workshop.
      • Replacement route: The bundle connects Docker and Kubernetes through a shared booking and learning group instead of separate dates. It requires more prior knowledge: Linux command-line skills and development or system administration basics.
    • CONTAINERAlternativeCHOICE
      Podman fundamentals

      Rootless containers, pods, images

      You build container images with Podman and run containers without root privileges, with persistent storage and network connections. You group related containers into pods.

      Afterwards, you can build Podman images, run containers without root privileges using networking and persistent storage, and group them into pods.

      Choose Podman instead of the Docker introduction if you want to run containers without root privileges. This preparation focuses on rootless containers with reduced privileges.

      4 learning moves

      1. Understand rootless operation

        Through Podman's architecture, you learn how containers run under your user account without a central daemon.

      2. Build and manage images

        You build images and manage them in registries to provide applications as a reusable basis for containers.

      3. Connect networking and storage

        With networks and volumes, you connect containers and retain data while checking file permissions in rootless operation.

      4. Group containers into pods

        In pods, you group related containers and check their communication across the shared network.

      • Recommended next step: Container experience helps with the Kubernetes introduction but is not a prerequisite for the fundamentals workshop.

  • Operations practice

    You deepen workload practice, scaling, access and network rules, operational signals and configuration per environment.

    • OPERATIONS PRACTICEOptionalOPTIONAL
      Manage software with Helm

      Charts, values, releases, upgrades, rollbacks

      Helm packages Kubernetes resources into reusable charts and manages their installations as releases. You install and develop charts, adapt them to different environments using values, and practise testing, upgrades and rollbacks.

      Afterwards, you can create Helm charts, adapt them with values, test them and install, upgrade and roll back releases.

      Choose this preparation if you maintain Helm charts as installation templates yourself: you also practise secrets integration and security rules. Tools such as Falco are installed through charts; CKA preparation already includes an introduction to Helm.

      4 learning moves

      1. Distinguish charts and releases

        You distinguish a chart as a software package from an installed release to separate the reusable template from its installation.

      2. Adapt configuration with values

        You adapt a chart to its target environment using values and understand which settings change the generated resources.

      3. Develop and test your own charts

        When creating charts, you separate templates from values and use tests to check whether different settings are applied correctly.

      4. Review upgrades and roll back

        Before upgrades, you review changes and practise rollbacks using the release history to respond to faulty updates.

Core route

Each number represents one workshop included in the totals, which may cover several skills.

  1. Workshop step 1 of 5:

    Kubernetes basics

    Practical foundations for later role responsibilities and certification goals involving hands-on exams.

    • KUBERNETES BASICSCore stepSelf-declaredCORE
      Kubernetes basics

      Architecture, pods, deployments, deployment strategies, services, namespaces, CoreDNS, storage and CSI, ConfigMaps, secrets, kubectl

      You deploy and expose applications with Kubernetes, then configure and inspect them using kubectl, the Kubernetes command-line tool. You also set up basic persistent storage for applications.

      Afterwards, you can deploy applications in Kubernetes, make them reachable, supply configuration and persistent storage, and inspect them with kubectl.

      You learn pods, deployments, services and kubectl as a practical Kubernetes foundation.

      5 learning moves

      1. Understand architecture and pods

        You trace how the control plane, nodes and pods work together and use kubectl to inspect the state of your first pods.

      2. Deploy and update applications

        With deployments, you deploy applications and compare update strategies to assess their risks.

      3. Access and name resolution

        Services make pods reachable while you organise resources with namespaces and check name resolution with CoreDNS.

      4. Separate configuration from images

        Through ConfigMaps and Secrets, you supply configuration and sensitive values to pods so they remain separate from the image.

      5. Check persistent storage

        You attach volumes to pods, explain the roles of CSI and StorageClasses, and check whether data survives a pod restart.

      • Prerequisite: Kubernetes basics are required; you learn Helm from scratch to install, configure and upgrade cluster software and applications and roll them back to earlier versions.
  2. Workshop step 2 of 5:

    Operations practice

    You deepen workload practice, scaling, access and network rules, operational signals and configuration per environment.

    Here you deepen your knowledge of workloads, scaling, network access and basic operational signals. Each learning path specifies whether this depth is core or optional.

    • OPERATIONS PRACTICECore stepSelf-declaredCORE
      Workloads and scaling

      StatefulSets, database operators, scheduling, resource management, HPA, VPA, KEDA

      You examine stateful workloads with StatefulSets and use database operators. Through resource settings and scheduling rules, you control Pod placement. You configure autoscaling with HPA, VPA and KEDA.

      Afterwards, you can examine StatefulSets, use database operators, control pod placement and configure autoscaling with HPA, VPA and KEDA.

      You run stateful applications, control pod placement with resource settings and scheduling rules, and configure autoscaling. This teaches you to distribute applications deliberately across shared clusters; access and network rules then add security controls.

      4 learning moves

      1. Understand stateful workloads

        Using a database running as a StatefulSet, you examine why stable pod identities and persistent storage belong together.

      2. Use database operators

        You set up database operators and consider their advantages and disadvantages to assess their role in database operations.

      3. Control resources and placement

        With resource requests and scheduling rules, you control which nodes pods can run on and observe their placement.

      4. Distinguish scaling approaches

        You configure HPA, VPA and KEDA, distinguishing pod counts, resource adjustments and events as a basis for scaling.

    • OPERATIONS PRACTICECore stepSelf-declaredCORE
      Networking, access and operations

      Ingress and Gateway API overview, service mesh overview, network policies, RBAC, monitoring, logging

      You place Ingress, Gateway API and service mesh in context and practise RBAC and network policies. With Prometheus and Grafana, you set up basic monitoring; with Loki, you set up logging. Gateway API migration and controller portability are outside the practical scope.

      Afterwards, you can assess networking approaches, restrict API access and communication, and set up basic monitoring and logging for Kubernetes.

      Here you first apply RBAC to restrict access rights and NetworkPolicies to limit network traffic in this path. You also set up operational monitoring and logging to provide data for later investigations.

      4 learning moves

      1. Place routing and service mesh in context

        You compare the roles of Ingress, Gateway API and service mesh to understand their areas of use and limitations.

      2. Restrict API access and communication

        With RBAC, you restrict API actions and with network policies, communication, treating these as separate protection tasks.

      3. Collect and display metrics

        You set up Prometheus and Grafana through operators to collect cluster metrics and make them visible in dashboards.

      4. Centralise logs and configure alerts

        With Loki, you centralise cluster logs and add basic alerts to bring together indications of operational problems.

  3. Workshop step 3 of 5:

    Role focus

    This learning path follows a role path, which optional topics deepen.

    • ROLE PATHCore stepROLE PATH
      Security

      Secure the cluster and the software supply chain.

      This begins the focus on security layers, hardening and the software supply chain.

    • ROLE COMPETENCYCore stepSelf-declaredROLE PATH
      Security fundamentals

      Security across cloud, cluster, container and code, control plane, Pod protection, access rights, threats, audit logs

      You practise safeguards and exam questions for Kubernetes and Cloud Native Security Associate (KCSA). Overview: runtime detection, admission policies, image scans, supply chains, certificate infrastructure and compliance. Required: Kubernetes and networking basics, Linux command-line practice; no substitute for cluster experience or practical security exam (CKS) prerequisites.

      Afterwards, you can explain safeguards for cloud-native systems, apply basic access and Pod policies and assess security signals.

      In KCSA preparation, you write and test network rules (NetworkPolicies), configure Pod Security Admission to enforce pod security standards and match threats to countermeasures. This security foundation is a useful stopping point for cluster teams; CKA is not required.

      4 learning moves

      1. Map security layers and threats

        You map threats to the cloud, cluster, container and code layers to understand responsibilities and security boundaries.

      2. Protect the control plane and access

        Using the API Server, etcd and RBAC, you examine how authentication, permissions and encryption protect cluster access.

      3. Apply Pod and network policies

        You test Pod protection and network policies to restrict disallowed container settings and unwanted connections.

      4. Assess security signals

        Image scans, runtime alerts and audit logs help you distinguish vulnerabilities from suspicious activity and API access.

      • DW25 KCSA Exam PreparationSecurity fundamentals with exercises and KCSA exam preparationIntermediate3 daysOnline, taught in GermanKCSA: Multiple-choice, 90 min, registration only USD 250 (one retake included), as of 4 August 2026; book and pay separately with the Linux Foundation, excluded from shown prices.
      7 more relationships
      • Recommended next step: The security role path first examines security layers and threats in Kubernetes.
      • Recommended next step: The security fundamentals establish context before deeper hardening; KCSA is not a prerequisite for CKS.
      • Optional further study: You can implement Kubernetes controls as tested policies with Kyverno or OPA Gatekeeper.
      • Optional further study: You can examine runtime events with Falco and test rules and alert routing.
      • Optional further study: For targeted network segmentation with Cilium, extend basic network policies with identity-based access and use Hubble to verify allowed and blocked connections.
      • Optional further study: If your team needs to secure service communication, use Istio to practise mutual authentication, encryption and access rules and investigate failures beyond the security overview.
      • Optional further study: If your team needs to store, rotate and issue secrets such as passwords centrally, you can request an introduction to HashiCorp Vault or OpenBao.
  4. Workshop step 4 of 5:
    • ROLE COMPETENCYCore stepSelf-declaredROLE PATH
      Cluster operations and troubleshooting

      kubeadm, container runtimes, etcd backup and recovery, CNI, scheduling, storage, RBAC, upgrades, troubleshooting

      Certified Kubernetes Administrator (CKA) preparation requires system administration or DevOps practice. You practise kubeadm cluster setup, upgrades, etcd backup and recovery, and diagnose network, application, storage and access faults. Passing CKA is required for the Certified Kubernetes Security Specialist (CKS) exam.

      Afterwards, you can build clusters with kubeadm, perform upgrades, back up and restore etcd, and systematically isolate operational faults.

      Passing CKA is required for CKS; preparation combines cluster setup, recovery and troubleshooting with knowledge of cluster control (control plane), state storage (etcd) and certificates for later hardening. You can skip preparation after passing CKA; it does not award CKA certification.

      5 learning moves

      1. Connect cluster components

        When building a cluster with kubeadm, you relate the control plane, container runtimes and CNI to control, execution and networking.

      2. Control placement and storage

        Using scheduling rules and persistent storage, you practise controlling where pods run and how stateful applications receive storage.

      3. Limit access with RBAC

        You assign appropriate permissions to users and service accounts through RBAC to define allowed API actions and their scope.

      4. Practise upgrades and recovery

        You practise ordered cluster upgrades, etcd backups and recovery to understand changes and the return to a backed-up state.

      5. Isolate faults by affected layer

        For network, application, storage and access faults, you separate symptoms from causes to test focused diagnostic hypotheses.

      • DW6 CKA Exam Preparationcovered in depth and practised with exam-like tasksIntermediate4 daysOnline, taught in GermanCKA: Performance-based exam, 120 min, registration only USD 445 (one retake included), as of 4 August 2026; book and pay separately with the Linux Foundation, excluded from shown prices.
      • Prerequisite: CKS preparation requires production cluster administration practice: allow time for this and the CKA exam. The Linux Foundation requires a passed CKA for the CKS exam, even with an expired credential; preparation alone does not qualify.
      2 more relationships
      • Optional further study: If your team uses Cilium, extend general networking practice with identity-based access rules, flow diagnostics using Hubble and encryption between nodes with WireGuard.
      • Optional further study: If your team needs control between application services, Istio extends general networking basics with encrypted, mutually authenticated connections, access rules and traffic management.
  5. Workshop step 5 of 5:
    • ROLE COMPETENCYCore stepSelf-declaredROLE PATH
      Secure the cluster and supply chain

      Hardening against CIS (Center for Internet Security), policies, secrets such as passwords, runtime, software supply chain, audit logs, forensics

      For Certified Kubernetes Security Specialist (CKS), you practise CIS benchmark hardening: AppArmor, seccomp, Pod Security, etcd encryption and default-deny network policies. You also work with software bills of materials, image signing, admission and vulnerability checks, OpenID Connect authentication, Falco runtime detection and incident analysis using audit logs.

      Afterwards, you can harden Kubernetes components, check images before admission and investigate security incidents using runtime data and audit logs.

      You harden cluster components against CIS security benchmarks, sign and verify images, detect suspicious runtime events and reconstruct incidents from audit logs. Usually, CKS preparation comes later, after passing CKA (expired certification counts) and gaining the required production cluster administration experience.

      5 learning moves

      1. Harden the cluster and access

        You check cluster components against CIS benchmarks and restrict access rights to identify weaknesses and unnecessary permissions.

      2. Protect Pods, secrets and networks

        You restrict container access with Pod Security, AppArmor, seccomp and network policies; etcd encryption protects stored secrets.

      3. Check images before admission

        You use bills of materials, signatures and vulnerability scans to check images and enforce admission rules for their use.

      4. Detect suspicious activity

        Falco rules detect suspicious runtime behaviour, while audit logs record critical API access for investigation.

      5. Contain and reconstruct incidents

        You isolate suspicious Pods and examine audit logs and forensic data to trace attack paths and causes.

      • DW7 CKS Exam Preparationdeepened and practised hands-onAdvanced4 daysOnline, taught in GermanCKS: Performance-based exam, 120 min, registration only USD 445 (one retake included), as of 4 August 2026; book and pay separately with the Linux Foundation, excluded from shown prices.
      • Prerequisite: Practised hardening, image delivery protection and incident analysis provide the basis for practical Kubernetes cluster security tasks.

Possible goals

This path builds the technical foundation for these goals.

  • GoalCluster securityYou practise hardening clusters and their components, securing the container image delivery chain and detecting suspicious runtime behaviour. You investigate incidents using runtime events and audit logs.

Further study

Optional further study; excluded from the workshop count, days and price.

Show 6 skills

  • Role focus

    This learning path follows a role path, which optional topics deepen.

    • ROLE COMPETENCYOptionalOPTIONAL
      Automate container image builds

      GitLab CI/CD: build, test and deliver, pipelines, runners for job execution, build outputs, security checks, test environments

      You create GitLab pipelines, control jobs, and build and publish container images. To these pipelines, you add scans and deployment steps and investigate pipeline failures. Git fundamentals are required.

      Afterwards, you can create GitLab pipelines to build, scan and publish container images, integrate test environments and diagnose job failures.

      Choose this specialisation after security fundamentals if your team needs automated image and source code checks. Independently of CKA/CKS, practise image scans and static application security testing (SAST) with GitLab CI/CD and gain the CI job experience required for policy workshops.

      4 learning moves

      1. Match jobs to runners

        You structure a GitLab pipeline into jobs and stages and assign runners to make the sequence and execution location clear.

      2. Publish images and build outputs

        You build container images for the registry and pass build outputs as artifacts so that subsequent jobs can use them.

      3. Integrate checks and test environments

        With scan jobs and deployments to test environments, you check images and applications within the delivery workflow.

      4. Diagnose pipeline failures

        Syntax checks and job logs help you distinguish configuration errors from runner, image access and permission problems.

      • Recommended next step: If you lack CI experience, you can build it in GitLab before working on policy tests. The policy workshops are not limited to GitLab.
    • DEPTH COMPETENCYOptionalCHOICE
      Policy as code

      Admission control, validation, mutation, exceptions, policy tests, CI

      You develop and test Kubernetes policies with Kyverno or OPA Gatekeeper and Rego. This includes examining validation, mutation and exception handling and integrating tests into CI. Git and CI fundamentals are required; the feature scope depends on the selected tool.

      Afterwards, you can develop Kubernetes policies with the selected tool, test them in CI and prepare their enforcement with narrowly scoped exceptions.

      If your team needs to enforce configuration rules automatically, write, test and roll out policies and exceptions with Kyverno or OPA Gatekeeper beyond the KCSA overview. Git branch and CI practice are required; after the Kyverno workshop, you can request KCA exam preparation.

      4 learning moves

      1. Understand admission and resource checks

        You distinguish checks on new API requests from checks on existing resources to understand the reach of a policy.

      2. Design validation and mutation

        With the selected tool, you define validation rules and limited mutations to check requirements or supply missing values.

      3. Test rules and integrate CI checks

        Allowed, violating and excluded resources become CI test cases so unintended policy behaviour is detected before deployment.

      4. Scope exceptions and enforcement

        Narrowly scoped exceptions and reviewed check results help you make an informed transition from observing violations to blocking them.

      Choose 1 of 2

      Gatekeeper with Open Policy Agent (OPA) for existing use or a deliberate Rego choice, otherwise Kyverno for YAML policies; only Kyverno aligns with requestable Kyverno Certified Associate preparation.

      • DW30 Introduction to KyvernoKyverno and CEL; also image signature and attestation verificationBeginner3 daysOnline, taught in German
      • DW31 Introduction to OPA Gatekeeper and RegoOPA Gatekeeper and Rego; ConstraintTemplates, Constraints and gatorIntermediate3 daysOnline, taught in German
      • DW45 Kyverno Certified Associate (KCA)Exam preparation on requestKCA: Multiple-choice, 90 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
    • DEPTH COMPETENCYOptionalDEPTH
      Runtime security

      Falco, rules, exceptions, Falcosidekick, event drops, incident handling

      You deploy Falco on Kubernetes, examine runtime events and test rules and exceptions. Through Falcosidekick, you route alerts. You also investigate dropped runtime events and routing failures in a prepared training environment.

      Afterwards, you can test Falco rules and exceptions, trace alerts through Falcosidekick and investigate runtime incidents and detection gaps in a training environment.

      Choose Falco if your team needs to detect suspicious activity in running containers. Beyond the Falco modules in KCSA and CKS preparation, you test rules and exceptions, route alerts and investigate causes of event collection losses.

      4 learning moves

      1. Capture runtime events with Falco

        As you deploy Falco, you follow events through to alerts to distinguish runtime detection from prevention.

      2. Test rules and exceptions

        Using triggering and non-triggering events, you test rules and narrow exceptions so expected behaviour does not obscure detection.

      3. Route alerts with context

        Through Falcosidekick, you trace alerts with process and workload context to a test destination so they can be assessed there.

      4. Investigate detection gaps and incidents

        Logs, metrics and control events help isolate event drops and routing failures and support an evidence-based incident handover.

    • DEPTH COMPETENCYOptionalDEPTH
      Cluster networking with Cilium

      Cilium, Hubble, L3/L4/L7 policies, FQDN egress, kube-proxy replacement, WireGuard

      You configure Cilium, follow network flows with Hubble and restrict access with policies. The work also involves examining kube-proxy replacement, WireGuard encryption between nodes and data path failures. eBPF programming is not a prerequisite.

      Afterwards, you can configure Cilium, restrict network access with policies and use Hubble and diagnostic data to isolate faults in service paths and rules.

      Choose Cilium if your team needs to segment network traffic precisely and trace connections with Hubble. Networking fundamentals are required; the workshop does not prepare you for an exam, and you can request subsequent CCA exam preparation.

      5 learning moves

      1. Place Cilium in the data path

        You check installation prerequisites and trace Pod and Service paths to understand Cilium's role in routing and load balancing.

      2. Inspect communication with Hubble

        Hubble flows reveal sources, destinations and dropped connections so you can identify required communication before restricting it.

      3. Restrict network access deliberately

        You test identity, port, HTTP and FQDN egress rules with allowed and denied requests to verify their effect on access.

      4. Check service paths and encryption

        With kube-proxy replacement and WireGuard, you check service paths and encryption boundaries to understand these operational options.

      5. Isolate data path faults

        You combine status, Hubble flows and endpoint data into a diagnostic path that extends to eBPF programs and Cilium maps when needed.

      • DW32 Introduction to CiliumBeginner3 daysOnline, taught in German
      • DW39 Cilium Certified Associate (CCA)Exam preparation on requestCCA: Multiple-choice, 90 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
    • DEPTH COMPETENCYOptionalDEPTH
      Service mesh with Istio

      Istio, traffic management, mTLS, authorization policies, JWT, troubleshooting

      You configure Istio for communication between services and external access. This includes practising mTLS, access controls and traffic management and examining service mesh operations. This focus does not replace an in-depth Gateway API migration workshop.

      Afterwards, you can use Istio to route service traffic, secure connections and access, and investigate causes of communication failures.

      Choose Istio if services need to verify each other's identity and communicate over encrypted connections: you configure mTLS and access rules for this. You can request subsequent ICA exam preparation.

      4 learning moves

      1. Understand responsibilities in the mesh

        The roles of Istiod and Envoy explain how Istio distributes configuration and controls communication between services.

      2. Direct traffic deliberately

        Routing rules and a gateway let you direct requests to service versions and enable external access.

      3. Secure connections and access

        You combine mTLS, authorization policies and JWT validation to encrypt connections and define which requests are allowed.

      4. Investigate failures across services

        Metrics, traces and proxy configurations help you investigate the causes of delayed or rejected requests in the mesh.

      • DW16 Introduction to Istio and Service MeshIntermediate3 daysOnline, taught in German
      • DW42 Istio Certified Associate (ICA)Exam preparation on requestICA: Performance-based exam / Multiple-choice, 120 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
    • DEPTH COMPETENCYOptionalON REQUEST
      Manage secrets centrally

      HashiCorp Vault, OpenBao, central storage, rotation, dynamic issuance

      HashiCorp Vault and OpenBao centrally store, rotate and generate secrets such as passwords, complementing Kubernetes Secrets, synchronisation via External Secrets Operator and encryption with SOPS or Sealed Secrets. OpenBao is an open-source fork of Vault. You can request introductions to Vault and OpenBao.

      An external store complements Kubernetes Secrets with central credential management, rotation and distribution: HashiCorp Vault if already used or licensed, OpenBao if an open-source licence and community governance are required. You can request the introductions; they never enter day or price totals.

      Choose Vault if already operated or licensed by your organisation, OpenBao if an open-source licence or community governance is required.

      • DW56 Introduction to HashiCorp VaultWorkshop on requestRequest
      • DW57 Introduction to OpenBaoWorkshop on requestRequest

Which workshops make up the Kubernetes Security example route?

The example route includes DW2, DW3, DW25, DW6 and DW7. It covers these skills: Kubernetes basics, Workloads and scaling, Networking, access and operations, Security fundamentals, Cluster operations and troubleshooting and Secure the cluster and supply chain.

EXAMPLE ROUTE (ROLE PATH: SECURITY)

Kubernetes Security

As a Kubernetes team, you practise risk assessment and access control through KCSA preparation. Experienced cluster admins practise hardening and incident analysis in CKS preparation after passing CKA; CKA preparation is then unnecessary. Specialisations add configuration rules, runtime detection, network protection and secrets.

Route scope
5
Training days
16
List price basis, per person, excl. VAT
€8,880
View the starting workshop for Introduction to Kubernetes (DW2)

Included in the totals: DW2, DW3, DW25, DW6 and DW7. Additional workshops are excluded.

Workshops in this example route

Each workshop shows its role, skills covered and planning details.

5 workshops, recommended technical sequence

Preparation

Preparation if needed

Excluded from the workshop count, days and price.
  • Git and collaboration

    If needed: 1 of 2

    You practise recording changes with commits, working on separate branches and checking changes in reviews. This preparation with Git or GitLab provides the branch practice required by the policy workshops.

  • Docker fundamentals

    If needed: 1 of 2

    • DW1 Introduction to Docker

      You examine how container images are built from layers and base images, and work with registries as image stores. This preparation lays the foundation for later vulnerability scanning and image signing.

      2 days, €1,110 excluding VAT

      Content & dates for Introduction to Docker (DW1)
    • DW8 Introduction to Podman

      Choose Podman instead of the Docker introduction if you want to run containers without root privileges. This preparation focuses on rootless containers with reduced privileges.

      3 days, €1,665 excluding VAT

      Content & dates for Introduction to Podman (DW8)
  • DW9 Introduction to Helm for Kubernetes

    Choose this preparation if you maintain Helm charts as installation templates yourself: you also practise secrets integration and security rules. Tools such as Falco are installed through charts; CKA preparation already includes an introduction to Helm.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Helm for Kubernetes (DW9)

Core route

  1. STARTING POINT (KUBERNETES BASICS)

    DW2 Introduction to Kubernetes

    You learn pods, deployments, services and kubectl as a practical Kubernetes foundation.

    SKILLS COVERED

    Architecture, pods, deployments, deployment strategies, services, namespaces, CoreDNS, storage and CSI, ConfigMaps, secrets, kubectl

    3 days, €1,665 excluding VAT

    Choose a date

    Content & dates for Introduction to Kubernetes (DW2)

  2. OPERATIONS PRACTICE

    DW3 Advanced Kubernetes

    You run stateful applications, control pod placement with resource settings and scheduling rules, and configure autoscaling. This teaches you to distribute applications deliberately across shared clusters; access and network rules then add security controls.

    SKILLS COVERED

    StatefulSets, database operators, scheduling, resource management, HPA, VPA, KEDA, Ingress and Gateway API overview, service mesh overview, network policies, RBAC, monitoring, logging

    2 days, €1,110 excluding VAT

    Choose a date

    Content & dates for Advanced Kubernetes (DW3)

  3. ROLE COMPETENCY

    DW25 KCSA Exam Preparation

    In KCSA preparation, you write and test network rules (NetworkPolicies), configure Pod Security Admission to enforce pod security standards and match threats to countermeasures. This security foundation is a useful stopping point for cluster teams; CKA is not required.

    SKILLS COVERED

    Security across cloud, cluster, container and code, control plane, Pod protection, access rights, threats, audit logs

    3 days, €1,665 excluding VAT

    Choose a date

    Content & dates for KCSA Exam Preparation (DW25)

  4. ROLE COMPETENCY

    DW6 CKA Exam Preparation

    Passing CKA is required for CKS; preparation combines cluster setup, recovery and troubleshooting with knowledge of cluster control (control plane), state storage (etcd) and certificates for later hardening. You can skip preparation after passing CKA; it does not award CKA certification.

    SKILLS COVERED

    kubeadm, container runtimes, etcd backup and recovery, CNI, scheduling, storage, RBAC, upgrades, troubleshooting

    4 days, €2,220 excluding VAT

    Choose a date

    Content & dates for CKA Exam Preparation (DW6)

  5. ROLE COMPETENCY

    DW7 CKS Exam Preparation

    You harden cluster components against CIS security benchmarks, sign and verify images, detect suspicious runtime events and reconstruct incidents from audit logs. Usually, CKS preparation comes later, after passing CKA (expired certification counts) and gaining the required production cluster administration experience.

    SKILLS COVERED

    Hardening against CIS (Center for Internet Security), policies, secrets such as passwords, runtime, software supply chain, audit logs, forensics

    4 days, €2,220 excluding VAT

    Choose a date

    Content & dates for CKS Exam Preparation (DW7)

Further study

Optional further study

Excluded from the workshop count, days and price.
  • DW14 Introduction to GitLab CI/CD

    Choose this specialisation after security fundamentals if your team needs automated image and source code checks. Independently of CKA/CKS, practise image scans and static application security testing (SAST) with GitLab CI/CD and gain the CI job experience required for policy workshops.

    2 days, €1,110 excluding VAT

    Content & dates for Introduction to GitLab CI/CD (DW14)
  • Policy as code

    If needed: 1 of 2

    If your team needs to enforce configuration rules automatically, write, test and roll out policies and exceptions with Kyverno or OPA Gatekeeper beyond the KCSA overview. Git branch and CI practice are required; after the Kyverno workshop, you can request KCA exam preparation.

  • DW33 Introduction to Falco

    Choose Falco if your team needs to detect suspicious activity in running containers. Beyond the Falco modules in KCSA and CKS preparation, you test rules and exceptions, route alerts and investigate causes of event collection losses.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Falco (DW33)
Show 2 more workshops
  • DW32 Introduction to Cilium

    Choose Cilium if your team needs to segment network traffic precisely and trace connections with Hubble. Networking fundamentals are required; the workshop does not prepare you for an exam, and you can request subsequent CCA exam preparation.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Cilium (DW32)
  • DW16 Introduction to Istio and Service Mesh

    Choose Istio if services need to verify each other's identity and communicate over encrypted connections: you configure mTLS and access rules for this. You can request subsequent ICA exam preparation.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Istio and Service Mesh (DW16)

Why is this route structured this way?

The route follows learning questions: each station builds on the previous one. Here, we explain why the transitions make sense.

Recommended learning sequence; the formal exam prerequisite is marked in the legend.

The route principle

Each station answers a different learning question.

  1. Deploy applications

    How do you deploy applications in Kubernetes, make them accessible and check their status?

  2. Restrict access

    Which access rights and network connections do you allow for your applications, and how do you monitor operations?

  3. Apply targeted controls

    Which security controls counter which threats, and how do you test their effectiveness?

  4. From CKA to CKS hardening

    After passing CKA, how do you practise hardening clusters and detecting and investigating incidents in CKS preparation?

The learning rationale in detail

Brief explanations clarify the transitions without repeating the route.

  1. DW3 then DW25: Recommended order

    Why do we recommend operational practice before security fundamentals?

    Practical work with access rights, network rules and operational monitoring makes security controls easier to understand. KCSA preparation requires Kubernetes fundamentals, Linux command line practice and networking basics. Equivalent experience can provide this knowledge; the preceding workshops are not attendance requirements.

  2. DW25 then DW6: Recommended order

    When is the security foundation enough, and when should you continue via CKA?

    KCSA preparation can complete your team's learning path. If you aim for CKS, the CKA stage prepares you for cluster operations and the required exam: the Linux Foundation requires passing CKA, not KCSA. Choose specialisations independently according to team tasks and workshop prerequisites. The core route excludes application code security, cloud provider access management and implementing a compliance programme.

  3. DW6 then DW7: Formal exam prerequisite

    What must you plan between CKA and CKS preparation?

    Both the CKS exam and workshop require passing CKA; expired certification counts, workshop attendance does not. The workshop additionally requires the production cluster administration experience specified on its page, advanced Linux skills and network security fundamentals. The finder does not check these additional prerequisites. Allow for the separately booked CKA exam and production cluster practice; back-to-back workshops are unrealistic for most participants.

What is fixed, what is flexible?

The status shows which core stations contribute to the totals and where prior knowledge or learning goals allow flexibility. Optional additions count only when selected.

  • Included in this route

    This station is included in your core route with an assigned workshop.

  • Equivalent alternative

    Choose Podman instead of the optional Docker introduction if running containers without root privileges is your focus.

  • Optional

    Optional workshops sit outside the core route; published offerings enter your personal plan only after you select them.

  • Formal exam prerequisite

    The Linux Foundation sets this prerequisite as the exam provider; you book and pay for the exam separately and directly there. Workshop attendance does not satisfy the prerequisite or award CKA or CKS certification.

  • On request

    Workshops and exam preparation on request: no public dates or prices, excluded from totals; scope, language, format and price agreed after a discovery call. Requests are not bookings or exam registrations; book and pay for exams separately with the Linux Foundation.

Sources for this route

Agenda · Practice lab · Exam body · checked on

View methodology and sources

How does the roadmap lead to practical experience?

The roadmap sets out competency goals and sequence; the workshop agenda shows the content. In practical workshops, you apply that knowledge in the browser-based Dojo. The certificate of attendance documents workshop participation but does not replace proof of passing an exam; exams for KCSA, CKA and CKS are taken separately through the Linux Foundation or CNCF.

From learning goal to application

4 clear steps

  1. Competency goal

    The learning goal describes a concrete task.

  2. Workshop agenda

    Content and sequence are clear.

  3. Dojo practice

    In practical workshops, you apply knowledge in Dojo exercises.

  4. Application & context

    The certificate of attendance documents participation, not certification.

What “covered” means and how we substantiate it

4 criteria: directly supported

  • Visible

    Content is transparent

    “Covered” is an editorial classification of the visible workshop agenda, not proof of assessed competence.

  • Structured

    The sequence is explained

    The agenda arranges topics in a clear learning sequence.

  • Applied

    Knowledge is applied in practice

    In practical workshops, you apply knowledge through exercises in the browser-based Dojo.

  • Distinguished

    Records remain separate

    The certificate of attendance and proof of passing an exam remain separate.

Reviewed by the expert team at DevNinjas GmbH

Sources checked on

Which Kubernetes learning path fits your goal?

Compare related paths by their skills and technical focus. Check each workshop’s prerequisites before booking.

Kubernetes Administrator

For administrators and operations teams with Linux experience: you practise building and maintaining Kubernetes clusters and fixing faults. The path prepares you for the Certified Kubernetes Administrator (CKA) exam, booked separately with the Linux Foundation. Optional depth follows your team responsibilities.

  • ALTERNATIVE ROLE PATH
  • Core route 12 days
  • 4 workshops
  • ROLE PATH: OPERATIONS

A good fit if you want to build on the same foundations with a different technical focus.

Core routes compared

In both core routes

  • Kubernetes basicsStart
  • Workloads and scaling
  • Networking, access and operations
  • Cluster operations and troubleshooting

Only in this core route

  • Manage software with Helm
Explore the Kubernetes Administrator learning path
Compare all Kubernetes learning paths

Frequently asked questions about the Kubernetes learning path

A learning path is a recommended sequence, with no obligation to book it all. The right workshops depend on your container knowledge, target role and practical experience. The displayed duration and price refer to the core route.

Can I attend KCSA preparation without a CKA certification?

Kubernetes and Cloud Native Security Associate (KCSA) preparation requires neither Certified Kubernetes Administrator (CKA) nor Certified Kubernetes Application Developer (CKAD) certification.

The KCSA workshop requires practical Kubernetes fundamentals, Linux command line experience and basic networking knowledge. Programming skills and experience with the security tools used are not required. If you lack those foundations, preparation can be booked separately; the learning-path overview explains how.

Do I need programming skills for CKS preparation?

Certified Kubernetes Security Specialist (CKS) preparation requires neither programming skills nor prior experience with Falco, Trivy or Cosign. The security tools are introduced during the workshop.

The CKS workshop requires cluster administration with kubectl and kubeadm. You should be comfortable interpreting Linux processes, files, network paths, TLS and YAML.

Can I continue the Kubernetes Security path with an expired CKA?

An expired CKA does not prevent you from continuing the Kubernetes Security path and also qualifies for the CKS exam, provided you previously passed CKA.

The CKS workshop does not require a CKA pass. You need administration practice with kubectl and kubeadm, plus confident use of Linux, TLS and YAML. The Kubernetes certification guide explains exam admission in detail.

Can Kyverno or Gatekeeper training replace dedicated CKS preparation?

The Kyverno and OPA Gatekeeper workshops develop Kubernetes policy skills and do not replace dedicated CKS exam preparation.

Kyverno training covers policies and their tests. OPA Gatekeeper and Rego training focuses on rules and their operation. For policy work, choose according to the tool you use. For the exam goal, there is dedicated CKS preparation.

Vincent Sturm, Key Account Manager

Discuss your team’s learning path with Vincent

Discuss goals, roles, timing, format and suitable workshop sequences with Vincent. You can explore technical questions with our trainers afterwards if needed.
View public workshop dates