2 — Image Signing

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

1 — Image Security

Why minimal or distroless base images shrink the attack surface far more than patching CVEs in a bloated one ever will.

7 — Policy Enforcement (OPA Gatekeeper, Kyverno)

Kyverno's native Kubernetes-resource policies trade Rego's expressiveness for a much shorter path from 'write policy' to 'policy enforced'.

4 — SBOM

An SBOM turns 'are we affected by this CVE' from a multi-day manual audit into a single query against a manifest already generated at build time.

3 — Sigstore & Cosign

Keyless signing binds an image to an OIDC identity and a public transparency log instead of a long-lived private key that can leak or expire.