CNCF [Cloud Native Computing Foundation] Courses

OmniBOR: Bringing the Receipts for Supply Chain Security

Capture a software artifact’s full dependency graph directly from build tools as an alternative to after-the-fact SBOM scans.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

From the Cluster to the Cloud: Lateral Movements in Kubernetes

How attackers move from Kubernetes containers into cloud workloads, and how defenders can detect and prevent those paths.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Beyond Cluster-Admin - Getting Started with Kubernetes Users and Permissions

Move beyond shared cluster-admin credentials by provisioning Kubernetes users and automating fine-grained permissions with RBAC.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

Security as Code - A DevSecOps Approach

Learn how to encode security checks in CI/CD pipelines, including writing CodeQL queries that detect vulnerabilities and misconfigurations.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Software Supply Chain Security with TAG Security

A discussion of working-group resources for improving software supply chain security, including a reference architecture, compromise catalog, and survey findings.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Zero Trust Workload Identity in Kubernetes

See how workload identity can replace shared secrets to authorize service-to-service interactions in a Zero Trust Kubernetes service mesh.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Improving Secure Pod-to-Pod Communication Within Kubernetes Using Trust Bundles

Trust bundles automate certificate delivery to Kubernetes pods, enabling mutual authentication and offering an alternative to service mesh approaches for cluster communication security.

• YouTube
• 38 minutes
• Self-Paced
• Free Video

From Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native

Trace cryptojacking’s shift into cloud-native systems and learn defensive measures spanning static analysis through runtime protection.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Cloud Native Security 101 - Building Blocks, Patterns and Best Practices

Learn how teams can secure cloud native applications across their lifecycle while keeping development and delivery moving.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Security Does Not Need to Be Fun - Ignoring OWASP to Have a Terrible Time

A practical introduction to using OWASP’s freely available tools to test web applications and make security easier to approach.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Verifiable GitHub Actions with eBPF

The talk examines how eBPF profiling and build verification can protect GitHub Actions pipelines, drawing lessons from two years of developing the approach.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

The Magic Behind OIDC - Understanding Open ID Connect for Workload Identity

See how OIDC lets CI workloads prove machine identity and obtain cloud API tokens without long-lived secrets.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Finding the Needles in a Haystack - Identifying Suspicious Behaviors with eBPF

See how eBPF system-call tracing gives GuardDuty rich process context to detect suspicious activity in Kubernetes containers.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Securing User to Service Access in Kubernetes

A look at securing user access to Kubernetes services, weighing ingress, proxies, service meshes, and encrypted networking against authentication, filtering, and load-balancing needs.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

Securing Diverse Supply Chains Across Interconnected Systems

A layered SBOM and vulnerability discovery workflow helps teams secure software supply chains and shorten developers’ response time.

• YouTube
• 21 minutes
• Self-Paced
• Free Video