3 — Sigstore & Cosign

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

1 — Image Security

Why minimal or distroless base images shrink the attack surface far more than patching CVEs in a bloated one ever will.

2 — Image Signing

A signature only proves who built the image, not that it's safe — signing and scanning solve different problems and neither substitutes for the other.

7 — Policy Enforcement (OPA Gatekeeper, Kyverno)

Kyverno's native Kubernetes-resource policies trade Rego's expressiveness for a much shorter path from 'write policy' to 'policy enforced'.

4 — SBOM

An SBOM turns 'are we affected by this CVE' from a multi-day manual audit into a single query against a manifest already generated at build time.