Kubernetes Admission Control with Safeguard

IntermediateFree5 modules · 13 lessons · ~2 min

About this course

Enforce image trust at the cluster boundary by wiring Safeguard's attestation, malware, vulnerability and secrets verdicts into Kubernetes admission control. You will learn the API server admission pipeline, webhook and ValidatingAdmissionPolicy mechanics, how to express the trust decision as tiered Safeguard Gates, and how to operate the control reliably with digest pinning, break-glass, observability and staged rollout. The course closes with incident runbooks for blocked deploys, webhook outages and compromised images already running.

What you'll learn

Admission Control Foundations

The API Server Request Path and Where Admission Sits
Webhook Configuration Anatomy: Mutating, Validating, Failure Modes and Selectors
ValidatingAdmissionPolicy and CEL Versus Webhooks

What Safeguard Enforces at Admission

The Trust Decision: Signature, Provenance, SCAL, Malware, Vulnerabilities and Secrets
Deploying the Admission Component: Helm Operator, Polling Posture, HA and Air-Gapped Clusters
End-to-End Walkthrough: From Registry Integration to a Blocked Pod

Designing Admission Policy

Policy Tiers, Exemptions and Break-Glass
Digest Pinning, Mutation and the Containers People Forget
Composing with Pod Security Admission, Kyverno, Gatekeeper and VAP

01Admission Control Foundations3 lessons

The API Server Request Path and Where Admission Sits
Webhook Configuration Anatomy: Mutating, Validating, Failure Modes and Selectors
ValidatingAdmissionPolicy and CEL Versus Webhooks

02What Safeguard Enforces at Admission3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Operations and Reliability

Latency Budgets, Caching, Timeouts, HA and Certificate Rotation
Observability: Audit Logs, Rejection Metrics, Dashboards and SIEM Forwarding

Rollout and Incident Runbooks

Staged Rollout: From One Namespace to the Fleet with GitOps and CI Gates
Incident Runbooks and the Final Checklist

The Trust Decision: Signature, Provenance, SCAL, Malware, Vulnerabilities and Secrets

Deploying the Admission Component: Helm Operator, Polling Posture, HA and Air-Gapped Clusters

End-to-End Walkthrough: From Registry Integration to a Blocked Pod

03Designing Admission Policy3 lessons

Policy Tiers, Exemptions and Break-Glass
Digest Pinning, Mutation and the Containers People Forget
Composing with Pod Security Admission, Kyverno, Gatekeeper and VAP

04Operations and Reliability2 lessons

Latency Budgets, Caching, Timeouts, HA and Certificate Rotation
Observability: Audit Logs, Rejection Metrics, Dashboards and SIEM Forwarding

05Rollout and Incident Runbooks2 lessons

Staged Rollout: From One Namespace to the Fleet with GitOps and CI Gates
Incident Runbooks and the Final Checklist2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.