Hands-on Lab·Kubernetes and Cloud Native Associate
The Four Cs of Cloud Native Security
Cloud, Cluster, Container, Code. The model is easy to recite and easy to misread as four separate problems. One probe per layer on a default cluster shows what each one actually controls, ending with a Secret read out of etcd in plaintext.
Security and the 4C Model Guide 26 of 46 Intermediate
- Kubernetes1.36.4
- etcd3.6.8
- Clusterkubeadm defaults, no hardening applied
- TimeAbout 18 min
- Reviewed22 August 2026
Written against the versions above. The defaults probed here are kubeadm's, and they are deliberate rather than accidental - `NodeRestriction` alone, and no encryption provider unless you configure one.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- Root on a control-plane node, to read the static Pod manifests and the listening sockets.
- The Pod Security admission guide, which covers the namespace-label half of the cluster layer.
-
Cloud: what the network can reach
-
Cluster: who the API server trusts
-
Container: root by default
-
Code: a Secret is not encrypted