Kubernetes and Cloud Native Associate (KCNA)

An operational framework that uses Git as the single source of truth for declarative infrastructure and applications. Changes to the desired state in Git are automatically applied to the target environment, and reconciliation ensures actual state matches desired state.

• Git is the single source of truth for declarative configurations.
• Automated agents continuously reconcile the cluster's actual state with Git's desired state.
• Provides an audit trail for all changes to infrastructure and applications.

A Kubernetes Operator is software that extends Kubernetes functionality by automating the management of complex, stateful applications using Custom Resources and Controllers.

• Automates operational tasks like provisioning, scaling, and backups.
• Encodes human operational knowledge into code.
• Uses Custom Resources (CRs) and Custom Resource Definitions (CRDs).

Helm Charts are packages of pre-configured Kubernetes resources that can be deployed as a single unit, simplifying application management.

• Defines, installs, and upgrades Kubernetes applications.
• Uses YAML-based templates for resource definitions.
• Manages application dependencies and configurations.

A centralized, secure repository for storing and managing container images within an organization, offering enhanced control, security, and compliance over image provenance and access.

• Provides granular access control for sensitive images.
• Enables vulnerability scanning and policy enforcement.
• Supports air-gapped or restricted network environments.

Kubernetes Operators, built upon Custom Resource Definitions (CRDs), extend the Kubernetes API to automate the management of complex stateful applications by encoding operational knowledge into software.

• CRDs define new API objects for custom resources.
• Operators provide the intelligence to manage these custom resources.
• Automate complex tasks like provisioning, scaling, backup, and recovery.

The action of uploading a built and tagged container image to a container registry, making it available for storage, distribution, and subsequent deployment to runtime environments.

• Stores the immutable image in a centralized repository.
• Enables versioning and tracking of images.
• Makes images accessible to Kubernetes clusters and other deployment tools.

Continuous Integration is a development practice where developers merge code changes frequently into a central repository, after which automated builds and tests are run.

• Automates build and test processes.
• Detects integration issues early.
• Requires frequent code commits.

Infrastructure as Code (IaC) is the practice of managing and provisioning computing infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.

• Treats infrastructure configuration like application code.
• Enables version control, automation, and consistency.
• Supports declarative and imperative approaches.

Helm serves as a package manager for Kubernetes, allowing developers to define, install, and upgrade even complex Kubernetes applications using 'charts' that bundle all necessary resources and configurations.

• Packages multiple Kubernetes resources (Deployment, Service, ConfigMap, etc.) into a single unit.
• Uses templates to allow customization via values.
• Simplifies repeatable deployments across different environments.

A private container registry service offered and managed by a cloud provider (e.g., AWS ECR, GCR, ACR), deeply integrated with their platform's security, IAM, and networking services.

• Offers high availability and scalability without self-hosting overhead.
• Integrates with cloud IAM for granular access control.
• Often includes built-in vulnerability scanning and image signing.

Continuous Deployment is a software release process that uses automated testing to validate if changes are ready for release, and then automatically deploys them to production.

• Automates the entire software release process.
• Requires robust automated testing.
• Eliminates manual intervention for production releases.

An Operator is a software extension to Kubernetes that makes use of custom resources to manage applications and their components. Operators follow Kubernetes principles, notably the control loop, to automate Day-2 operations for complex, stateful applications.

• Automates Day-2 operations: upgrades, backups, scaling, recovery.
• Extends Kubernetes API with Custom Resource Definitions (CRDs).
• Continuously reconciles desired state with actual state.

A development practice where all code, configuration, and artifacts are managed and version-controlled within a Git repository, enabling collaboration, traceability, and automated processes.

• Serves as the single source of truth for all project assets.
• Facilitates collaboration through branching and merging.
• Provides a complete history of changes for auditing and rollback.

Detailed records generated by the Kubernetes API Server that track all requests made to the cluster, including who made the request, when, from where, and what action was performed, crucial for security and compliance.

• Records all authenticated requests to the API Server.
• Captures user, timestamp, source IP, and resource accessed.
• Essential for security monitoring, forensic analysis, and compliance.

A feature of the Linux kernel that partitions kernel resources such that a process or set of processes has its own isolated view of the global system resources.

• Fundamental for container isolation.
• Each namespace type isolates a specific resource (PID, network, user, mount, UTS, IPC).
• Prevents processes from seeing or interacting with resources outside their namespace.

An approach to security that integrates security practices and testing earlier in the software development lifecycle (SDLC), aiming to identify and mitigate vulnerabilities as early as possible.

• Moves security from the end to the beginning of the SDLC.
• Reduces cost and effort of fixing vulnerabilities.
• Includes practices like SAST, DAST, image scanning in CI/CD.

Components that intercept requests to the Kubernetes API server after authentication and authorization, but before persistence to the object store, to modify or validate objects.

• Can be Mutating (modify objects) or Validating (reject objects).
• Webhooks allow external services to implement custom admission logic.
• Crucial for enforcing security policies like image validation, resource quotas, etc.

A built-in Kubernetes admission controller that enforces Pod Security Standards (PSS) on Pods, ensuring they adhere to predefined security policies.

• Enforces 'Privileged', 'Baseline', and 'Restricted' security standards.
• Can be configured at the namespace level to 'enforce', 'audit', or 'warn'.
• Directly addresses common Pod security misconfigurations.

A dedicated infrastructure layer that handles service-to-service communication, providing capabilities like traffic management, observability, and robust security features such as mutual TLS (mTLS) and fine-grained access control.

• Encrypts inter-service communication (mTLS).
• Enforces Layer 7 (application layer) policies.
• Provides centralized control over network security within the cluster.

The central component of the Kubernetes control plane that exposes the Kubernetes API. It is responsible for serving the API, authenticating requests, authorizing access, and validating data.

• Entry point for all cluster communication.
• Handles authentication and authorization.
• Validates and processes API requests.

The practice of protecting containers during their execution phase by monitoring for suspicious activities, enforcing policies, and preventing unauthorized actions.

• Focuses on active threat detection.
• Monitors system calls, file access, network activity.
• Can enforce policies to stop malicious behavior.

A DevSecOps principle that advocates for integrating security practices and testing early in the software development lifecycle, such as using Static Application Security Testing (SAST) to analyze code for vulnerabilities.

• Identifies vulnerabilities in source code before execution.
• Helps developers fix issues early, reducing cost and effort.
• Part of a proactive security strategy in CI/CD.

A method of regulating access to computer or network resources based on the roles of individual users within an enterprise. In Kubernetes, it uses Roles/ClusterRoles and RoleBindings/ClusterRoleBindings to grant permissions.

• Uses Roles to define permissions.
• Uses RoleBindings to grant Roles to subjects (users, service accounts).
• Enforces least privilege by granting only necessary access.

A set of predefined security policies in Kubernetes that define different levels of Pod isolation and restriction, from highly permissive to highly restrictive, to help users enforce security best practices.

• Three levels: Privileged, Baseline, Restricted.
• Enforced by Pod Security Admission (PSA).
• Helps prevent common security vulnerabilities in Pods.