7 — Policy Enforcement (OPA Gatekeeper, Kyverno)

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

1 — Image Security

Why minimal or distroless base images shrink the attack surface far more than patching CVEs in a bloated one ever will.

2 — Image Signing

A signature only proves who built the image, not that it's safe — signing and scanning solve different problems and neither substitutes for the other.

4 — SBOM

An SBOM turns 'are we affected by this CVE' from a multi-day manual audit into a single query against a manifest already generated at build time.

3 — Sigstore & Cosign

Keyless signing binds an image to an OIDC identity and a public transparency log instead of a long-lived private key that can leak or expire.