DevSecOps
Image scanning, secrets management, supply-chain security, and runtime defense.
“Duolingo for DevOps. One concept = one 2-4 minute video. Never introduce a concept before its prerequisites. Every lesson builds on the last.”
0 / 29 lessons readyaudience: security-conscious teams29 lessons planned
1. Security
29 lessonsSecurity is a shared responsibility, but DevOps often owns the infra security posture — RBAC, secrets, network policies, image supply chain.
Container Security
- The image supply chain4m 00sComing soon
- Trivy — scanning images and IaC4m 00sComing soon
- Grype + Syft for SBOMs4m 00sComing soon
- Signing images with cosign4m 00sComing soon
- Distroless base images4m 00sComing soon
- Falco — runtime security4m 00sComing soon
- seccomp and AppArmor profiles4m 00sComing soon
RBAC Deep Dive
- RBAC verbs and resources4m 00sComing soon
- RoleBindings vs ClusterRoleBindings4m 00sComing soon
- kubectl auth can-i3m 30sComing soon
- User impersonation for testing4m 00sComing soon
- Auditing RBAC in production4m 00sComing soon
Secrets Management
- Secrets vs env vars vs config3m 30sComing soon
- Sealed Secrets — commit-safe secrets4m 00sComing soon
- SOPS — encrypted YAML4m 00sComing soon
- External Secrets Operator4m 00sComing soon
- Secret rotation patterns4m 00sComing soon
- SSH key management at scale4m 00sComing soon
HashiCorp Vault
- Vault — the mental model4m 00sComing soon
- Auth methods — how Vault knows who you are4m 00sComing soon
- KV engine — static secrets4m 00sComing soon
- Dynamic secrets — the killer feature4m 00sComing soon
- Transit engine — encryption as a service4m 00sComing soon
- Vault policies4m 00sComing soon
- Vault HA and Raft storage4m 00sComing soon
Network Policies and Zero Trust
- Default-deny network policies4m 00sComing soon
- Ingress vs egress rules4m 00sComing soon
- Cilium — eBPF-powered network policies4m 00sComing soon
- Zero-trust in Kubernetes4m 00sComing soon