M9sweeper, the Open Source Kubernetes Security Platform
summary
Open source platform m9sweeper bundles and runs real tools against clusters with a UI and Helm charts, automating audits and policy enforcement. It runs kube-bench (example finding: kubelet server cert rotation unset), runs kube-hunter (finds service account injection and API info leaks), scans images with trivy, enforces OPA/Gatekeeper constraints, and monitors runtime syscalls with project Falco. Demo shows k8z Helm chart, exception workflow and daily audits working end to end.
AI-written summary · about
chapters (31)
- 0:00intro
- 0:27preamble
- 1:184 c's of cloud security
- 2:22lab summary - layers covered
- 3:19cloud: kubernetes architecture
- 4:25k8s security best practices
- 6:27role based access control
- 7:50sample role
- 8:21sample role binding
- 8:58why use tools?
- 10:14demo: kube-bench
- 13:28container: what is virtualization?
- 14:06what is a container?
- 15:59degrees of isolation
- 17:41parts of a container image
- 19:24docker file example
- 20:09container breakout
- 20:46preventing container breakout
- 25:31limiting linux kernal calls
- 27:27kubesec
- 28:39pod security admissions
- 31:42network policies
- 32:50sample network policy
- 33:52shortcomings of built-in features
- 34:51extending kubernetes: opa and gatekeeper
- 35:31lab: gatekeeper
- 39:06cve scanning with trivy
- 42:07limiting linux kernel calls
- 42:45demo: project falco
- 45:41summary
- 46:00questions?
related talks
23mSecuring Kubernetes with m9sweeper
32mStrengthening Kubernetes Security
38mOpen Source Security Tools for Kubernetes Applications
33mKubernetes is Open by Default, Use Open Source to Secure
30mA Monitoring Platform for Kubernetes Cluster Security
36mContinuous Security Testing with OWASP secureCodeBox in Kubernetes
37m"A Monitoring Platform for Kubernetes...
06mOpensource Container Security: A Brief Overview