Kubernetes Security Low-Hanging Fruit
summary
Focuses on concrete, fast wins: replace full OS images with distroless images to remove shells and package managers; enforce least-privilege via structured RBAC so service accounts can only access needed secrets; block lateral movement with network policy and use mTLS or a service mesh for workload identity; run image vulnerability scans and image signing, isolate CI credentials to avoid release paralysis, and validate cluster config with kube-bench and docker-bench plus admission controllers (restricted PodSecurityPolicy) to stop risky pods.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:54Background: Kubernetes & Container Security
- 5:13Background: Attacks on Kubernetes
- 9:47Levels of Defence
- 19:54Recommendations: the Low-Hanging Fruit
related talks
33mKubernetes Security Jumpstart
41mKubernetes Security Jumpstart
35mKubernetes Security - Challenge and Opportunity?
22mSecuring Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
34mKubernetes Security 101: Best Practices to Secure Your Cluster
19mKubernetes Security: Navigating the Real-World Challenges
43m6 Strategies to Bring Order to Kubernetes Security Disruptions