SecNet.Work · Harbor Cloud

Make cloud trust boundaries visible.

Move from application to infrastructure. Follow the same service through identity, image, Pod and network; distinguish a control’s presence from evidence that it works.

8 TR/EN modules · 24 scenarios

Start at the identity boundaryPrevious package: software security

Which boundaries does a request cross?

Select a boundary to reveal ownership, acceptance decisions and required evidence. This map describes a fictional service review.

Identity

Owner
IAM and platform team
Acceptance question
On whose behalf and within which scope do I accept the request?
Required evidence
Expected issuer/audience/subject; wrong-tenant and action denials.
Open this boundary guide

Study sequence for your role

  1. 1Cloud identity, IAM and RBAC
  2. 2Container images and the supply chain
  3. 3Kubernetes workloads and admission security
  4. 4Cloud networking, segmentation and service identity
  5. 5IaC, plan review and drift management
  6. 6Cloud secrets, KMS and rotation
  7. 7Cloud runtime detection and response
  8. 8Cloud and Kubernetes recovery exercise

A study recommendation; choices stay on the open page. It does not award a qualification, certificate or account career achievement.

Find Academy cloud courses ↗Choose a target role in Academy ↗

Guides and three-level exercises

8 modules

01

Cloud identity, IAM and RBAC

Harbor Desk now runs in the cloud. Separate human, pipeline and workload identities, and demonstrate least privilege without confusing sign-in with resource authority.

Beginner → intermediate → advanced
02

Container images and the supply chain

Trace which contents were released by which builder and tests instead of trusting a label. Assess image, registry and runtime separately.

Beginner → intermediate → advanced
03

Kubernetes workloads and admission security

A running Pod is not a secure Pod. Inspect effective security context across regular, init and helper containers and the admission policy actually enforced.

Beginner → intermediate → advanced
04

Cloud networking, segmentation and service identity

Trace ingress and egress independently. Test default-deny claims against actual CNI behavior, additive permissions and application authorization.

Beginner → intermediate → advanced
05

IaC, plan review and drift management

Move from formatting checks to actual change decisions. Assess Terraform plan/state sensitivity, the applied plan and console drift independently.

Beginner → intermediate → advanced
06

Cloud secrets, KMS and rotation

Separate encoding, encryption, access and rotation. Complete new-secret creation with safe consumer migration and revocation of old authority.

Beginner → intermediate → advanced
07

Cloud runtime detection and response

Turn audit records into actionable incidents. Connect workload identity, response ownership, credential revocation and the recreating controller.

Beginner → intermediate → advanced
08

Cloud and Kubernetes recovery exercise

Move from Pod Ready to demonstrated business recovery. Plan recovery of cluster records, persistent data, identities, keys and dependencies together.

Beginner → intermediate → advanced

Inspect the manifest locally.

Two synthetic Deployments, 24 evidence models and a Node.js inspector that actually reads selected configuration fields. No npm install, cloud account or cluster connection. Not full API/PSS validation or a live security assessment.

Open the browser review desk
Download the Harbor Cloud kit