Container and Kubernetes security policy design
summary
Demo builds a three‑node multipass cluster, installs Tigera operator and Calico from a private registry, and proves the controls work end to end. Uses Calico eBPF data plane and VPP as options, enables Prometheus metrics and node_exporter for monitoring, and runs tigera image scanner to show an Ubuntu‑based image with two vulnerabilities versus a scratch image with none. Applies namespace, host endpoint, and deny app policy resources (including global policies) and shows pods actually blocked or allowed.
AI-written summary · about
chapters (11)
- 0:00Container security policy design
- 2:43Project Calico capabilities
- 5:14Application modernization
- 10:13Container security best practices
- 13:21Kubernetes network segmentation
- 15:27Demo setup and environment
- 16:34Scanning container images
- 18:43Installing Calico privately
- 24:19Implementing segmentation policies
- 28:18Monitoring infrastructure
- 31:11Conclusion and resources
related talks
23mContainer and Kubernetes security policy design: 10 critical best practices
33mNavigating the Container Jungle
46mContinuous Kubernetes Security
30mA secure journey on Kubernetes
52mImplementing holistic security for containers and Kubernetes
30mSecuring Kubernetes Multi-Tenancy
39mExploring Container Security: A DevSecOps journey securing a fake shop - Jeremy Guerrand
24mOne stop talk for kubernetes security !!