Securing the Kubernetes Ecosystem
summary
Claims that 67% of orgs delay deploys and 46% lose revenue from Kubernetes incidents and proposes a five level framework that moves security from 20% at infrastructure to 100% at code. Architecture adds a firewall before API management, subnets and NS, Calico network policies with default deny, Istio mTLS encryption, image scanning and signing with Trivy/Clair and ACR/ECR, secrets in Azure Key Vault or Sealed Secrets, and pipeline code scans and policy enforcement using SonarQube and OPA.
AI-written summary · about
chapters (11)
- 0:00Introduction to Con 42 DevSecOps 2024
- 0:16Agenda Overview
- 0:40Presenter Introduction
- 0:53Kubernetes Security Statistics
- 1:22Multi-Level Security Approach
- 3:14Level 1: Infrastructure Security
- 4:40Level 2: Cluster Security
- 6:23Level 3: Container Security
- 7:24Level 4: Application Security
- 8:15Level 5: Code Security
- 10:49Final Thoughts and Conclusion
related talks
19mHow to Secure Your Kubernetes Clusters
22mSecuring Kubernetes
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
26mMulti-layer hardening in Kubernetes
41mKubernetes Security Jumpstart
46mContinuous Kubernetes Security
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
43m6 Strategies to Bring Order to Kubernetes Security Disruptions