CNCF [Cloud Native Computing Foundation] Courses

So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup

Recommendations for operating a private Sigstore, including the trust and transparency safeguards needed to secure artifact signing.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

How to Trust Your Open Source Software Using Scorecards

Learn how to use OpenSSF Scorecard results to assess open-source project health, automate dependency checks, and build a simple policy for software dependencies.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

How to Secure Your Supply Chain at Scale

A high-level framework for combining open-source tools to secure a large-scale software supply chain across code, vulnerabilities, configurations, and Kubernetes deployments.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

Standardization and Security - Improving Cloud Security Posture Through Standardization

A case for reducing tool and workflow choices through standardization to improve cloud security and ease team inefficiency.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Securing Self-Hosted GitHub Actions with Kubernetes and Actions-Runner-Controller

Examines how to reduce security risks when running self-hosted GitHub Actions runners on Kubernetes, from cluster boundaries to runner images.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Application Security for Better Business Value - Expert Insights

A practitioner panel connects shift-left application security and secure cloud-native pipelines with reduced compliance risk and room for innovation.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Network Security at Scale: L3 Through L7 at Splunk

A look at how Splunk secures multi-cloud Kubernetes connectivity across network layers while balancing lower-layer controls with L7 identity and flexibility.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

More Than Just a Pretty Penny - Why You Need Cybersecurity in Your Culture

Building cybersecurity into workplace culture by empowering employees to spot social engineering and own mistakes.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Fighting the Next War - Future Threats to OSS and Software Supply Chain Security

A keynote considers how emerging attacks, including AI-enabled threats, could affect open-source projects and software supply chains.

• YouTube
• 17 minutes
• Self-Paced
• Free Video

Establishing a Production Zero Trust Architecture

Build a production zero trust strategy around workload identities, policy controls, observability, and onboarding legacy systems.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Cryptographic Agility: Preparing Modern Apps for Quantum Safety and Beyond

Learn how crypto-agility schemes can prepare modern and legacy applications for migration to quantum-safe cryptography.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Identity Based Segmentation for Zero Trust Architecture

Explains how identity-based authorization and identity-aware proxies can replace network perimeter trust in cross-cloud application communication.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

Zero-Trust Tunnel: Exploring Security and Simpler Operations with Istio Ambient Mesh

Explore Istio Ambient Mesh’s sidecarless design, where a zero-trust tunnel secures Layer 4 traffic and waypoint proxies apply Layer 7 policies.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Package Transparency for WebAssembly Registries

Warg uses verifiable data structures inspired by Certificate Transparency to make WebAssembly package registries auditable and resistant to operator compromise.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Get Your Security Priorities Straight - Identifying Workloads Under Real Threat with Context

A context-aware system uses MITRE categories and production-cluster results to distinguish urgent Kubernetes workload threats from lower-priority risks.

• YouTube
• 27 minutes
• Self-Paced
• Free Video