More resources to have fun with kubernetes from a security point of view and for learning:

challenges

If you had fun with the Damn Vulnerable Web Application (DVWA), there is something equivalent for Kubernetes from Madhu Akula: Kubernetes Goat. You can also deploy your own playground.

K8S lan party seems also quite promising. (from Wiz)

tooling

offensive

Peirates is a bit alike a (still lightweight) Metasploit (payload) for k8s. One “batteries included” binary.

defensive

In order to ensure that your Kubernetes cluster follows the CIS secure configuration guidelines, you can use kube-bench. Also note the Trivy integration. Not a golden bullet, but an utility to shrink the attack surface and checking for PoLP.

For signing images to secure the supply chain, check out the sigstore project.