Track 11: Security Deep Dive

You've already met security in pieces across this curriculum: non-root containers, minimal images, and build-time secret handling in 02-docker; Kubernetes RBAC and NetworkPolicy in 03-kubernetes; Azure AD-integrated cluster RBAC and Key Vault via the CSI driver in 07-aks; and OIDC-based, secretless CI in 10-cicd-and-gitops. Each of those taught security as a footnote to another topic. This track makes security the topic.

It's a genuine deep dive across the whole stack: how to think about security (threat modeling and the shared-responsibility model), how to find problems (image scanning, supply-chain hygiene), how to protect secrets (Key Vault patterns, rotation, why long-lived CI credentials are a liability), how to constrain what runs (Pod Security Admission, securityContext), how to enforce policy as code (OPA/Gatekeeper and Azure Policy), how to build defense in depth across the network, and finally what to actually do when something is compromised (incident response and where the signals live).

What this track assumes and won't re-teach. You already know why non-root and minimal images matter (track 02), how Kubernetes RBAC and NetworkPolicy objects work (track 03), and how AAD-RBAC and the Key Vault CSI driver are wired up on AKS (track 07). This track cites those modules and builds past them — it does not repeat their basics. If any of those feel shaky, redo them first; everything here compounds on them.

What this track only previews. Two topics get a deliberate light touch here because later tracks own them: image signing and SBOMs (previewed in module 01, owned by 18-supply-chain-security) and governance at scale across management groups and landing zones (previewed in module 05, owned by 17-governance-at-scale). Service mesh mTLS is likewise previewed in module 06 and owned by 13-service-mesh. When you see "preview," it means enough to connect the dots, not the full treatment.

Cost warning: several modules touch real Azure resources (Defender for Cloud plans, Azure Policy assignments, an AKS cluster for the admission and policy exercises). Azure Policy assignments themselves are free, but a running AKS cluster bills for its node VMs and Defender for Containers is a paid plan — clean up clusters with az group delete when you're done for the day, and disable any Defender plan you enabled for a lab.

How this track works

  • Go in order — the mental model in module 00 frames every module after it, and the capstone integrates all of them.
  • Every module (except this index and the capstone) follows the same shape: Why this matters → Concepts → Command reference → Hands-on exercises → Independent challenge → Common mistakes & troubleshooting → Checkpoint quiz → Next. Two modules also carry a Cumulative review.
  • Exercises use real tools wherever feasible: Trivy against real images, a real Gatekeeper ConstraintTemplate on a local kind cluster, Pod Security Admission on a real namespace, and a real Azure Policy assignment.
  • Module 08 is a capstone with no quiz or challenge — it asks you to combine a scanned-and-hardened image, an enforced Gatekeeper policy, restricted Pod Security Admission, an Azure Policy guardrail, and a written incident-response runbook into one coherent, defensible deployment.

Modules

# Module What it covers Rough time
00 security-mental-model-and-threat-modeling STRIDE, attack-surface thinking, trust boundaries, the shared-responsibility model for AKS/ACA 60-75 min
01 image-scanning-and-supply-chain-basics Trivy and Defender for Containers, scanning in CI before push, base-image hygiene, a light signing/SBOM preview 75-90 min
02 secrets-management-in-depth CSI Secrets Store rotation, Key Vault vs. HashiCorp Vault, why long-lived CI secrets are a liability, OIDC recap 75-90 min
03 pod-security-and-admission-control Pod Security Standards/Admission, securityContext deep dive — capabilities, seccomp, read-only root FS 75-90 min
04 policy-as-code-opa-gatekeeper OPA/Gatekeeper: ConstraintTemplates, Constraints, writing a real blocking policy, audit vs. enforce 90 min
05 azure-policy-and-governance-guardrails Built-in definitions, assignments, Deny/Audit/DeployIfNotExists effects, initiatives, a governance-at-scale preview 75-90 min
06 network-security-in-depth Defense in depth across NSGs, Azure Firewall, NetworkPolicy egress, and a service-mesh mTLS preview 75-90 min
07 incident-response-and-security-monitoring Isolate/snapshot/rotate/root-cause, Defender for Cloud, Azure Monitor alerts, audit logs 75-90 min
08 hashicorp-vault-in-depth Run Vault for real: KV versioning, the database secrets engine, dynamic credentials, and lease revocation 75-90 min
09 capstone-project End-to-end: hardened image, Gatekeeper policy, restricted PSA, Azure Policy guardrail, incident-response runbook 3-5 hours

Prerequisites

  • Everything from 02-docker module 09 (non-root, minimal images, secrets not in layers, docker scout).
  • Everything from 03-kubernetes module 11 (RBAC, ServiceAccounts, NetworkPolicy, Calico on kind).
  • Everything from 07-aks module 07 (Azure AD-integrated RBAC, managed/workload identity, Key Vault CSI driver).
  • Familiarity from 10-cicd-and-gitops with CI pipelines and OIDC-based, secretless authentication to Azure.
  • An active Azure subscription with permission to create Azure Policy assignments and (for one module) enable a Defender for Cloud plan.

Back to main curriculum

Start here → 00-security-mental-model-and-threat-modeling/README.md