CNCF [Cloud Native Computing Foundation] Courses

Container Images and Security 101: 5 Need to Know Facts

Five key facts demystify how container images work and how security tools and practices apply to them.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Teach Your SBOM New Tricks with Bomshell

Use Bomshell scripts to query, combine, and reshape SBOMs across formats.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

Automating Configuration and Management of GitHub Repositories with Minder

Use custom Rego rules in Minder to apply consistent security settings across multiple GitHub repositories.

• YouTube
• 59 minutes
• Self-Paced
• Free Video

Demystify Modern Signing: Keys, Certificates, and Envelopes

A practical look at how modern signing tools use keys, envelopes, and certificates, ending with command-line signature verification.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

Is the Internet on Fire? Strategies for Mitigating Open Source Software Vulnerabilities

Examines how SBOMs, source review, signing, incident response, and breach-resilient system design can help defend open source software.

• YouTube
• 32 minutes
• Self-Paced
• Free Video

Kubernetes Deep Dive - Elevating ML Workload Monitoring to Art

A practical approach to monitoring AI/ML accelerator workloads in Kubernetes through node health checks, observability, and real-world issue diagnosis.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Brave New World - Welcoming New AI Identity Challenges

Explores how AI identities differ from human identities and demonstrates an open-source authentication system designed for AI applications.

• YouTube
• 32 minutes
• Self-Paced
• Free Video

Network ACLs Made Easy: Establishing Zero Trust Network Policies

A case study in automating least-privilege network ACLs from historical traffic, using AWS VPC Flow Logs, Rust, and Terraform.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

Shift Down Security - How Platform Teams Can Help Break the Logjam

Platform-layer policy as code can automate security guardrails so developers and security teams can focus on their core work.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

Threat Modeling for AI Apps with Attacks as Code

See how threat modeling for AI apps can be automated by encoding attack techniques as security experiments and verifying app behavior continuously.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Implementing AI Risk Management Framework with Policy-as-Code Automation

Maps trusted AI principles to the NIST AI RMF and demonstrates reusable policy-as-code controls for assessing, assuring, and red-teaming AI systems on Kubernetes.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Decoding 8 Real-World Cloud Identity Breaches

Eight real cloud breaches reveal how attackers exploit mismanaged identities, with a practical takeaway from each case.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Sailing the Security Seas with Tetragon Tutorial

Get started with Tetragon by using its CLI to filter and examine runtime events and strengthen security.

• YouTube
• 1 hour 12 minutes
• Self-Paced
• Free Video

Scan, Patch, VEX - Using Open Source Tools to Manage Vulnerabilities in Containers

Learn how Trivy, Copacetic, and VEX can automate vulnerability management and reduce noise across cloud native container workloads.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

From Risks to Resilience: Leveraging CNCF Projects Against Kubernetes' OWASP Top 10

Maps CNCF projects to risks in the OWASP Kubernetes Top Ten, outlining ways to strengthen Kubernetes deployment security.

• YouTube
• 38 minutes
• Self-Paced
• Free Video