4 — SBOM

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

1 — Image Security

Why minimal or distroless base images shrink the attack surface far more than patching CVEs in a bloated one ever will.

2 — Image Signing

A signature only proves who built the image, not that it's safe — signing and scanning solve different problems and neither substitutes for the other.

7 — Policy Enforcement (OPA Gatekeeper, Kyverno)

Kyverno's native Kubernetes-resource policies trade Rego's expressiveness for a much shorter path from 'write policy' to 'policy enforced'.

3 — Sigstore & Cosign

Keyless signing binds an image to an OIDC identity and a public transparency log instead of a long-lived private key that can leak or expire.