Lines of Defence – Securing Your Kubernetes Clusters
summary
Demoed an actual attack chain and concrete fixes: an exposed kubelet unauthenticated on 10250 lets an attacker read pod logs and extract a service account token, which because of a clusterrolebinding→cluster-admin grants full cluster access; fix is to disable automountServiceAccountToken, switch kubelet auth to webhook and remove overly-broad bindings. Shows image and manifest scanners (kubesec, trivy/grype), etcd encryption setup plus compaction/defrag to purge old plaintext, mTLS via Istio, HashiCorp Vault/CSI for secrets, Falco and AppArmor for runtime detection and host hardening.
AI-written summary · about
chapters (22)
- 0:00Kubernetes security challenges
- 1:06Security in Kubernetes
- 4:15Kubernetes cluster architecture
- 12:43Greek mythology analogy
- 15:53Secure Kubernetes lab setup
- 18:43Firewall rules and network security
- 20:50Exploiting insecure kubelets
- 25:16Securing kubelets with auth
- 27:21RBAC and service accounts
- 33:40Encryption strategies
- 36:06Secrets management pitfalls
- 41:55Transport encryption
- 49:44Encrypting etcd data
- 1:01:21etcd encryption challenges
- 1:04:04HashiCorp Vault for secrets
- 1:07:14Static pod analysis
- 1:11:38Image scanning
- 1:14:52Admission control with OPA
- 1:21:38AppArmor host security
- 1:26:31Kubernetes auditing
- 1:32:23Threat detection with Falco
- 1:35:16Security benchmarking with kube-bench
related talks
43mKubernetes Security: Attacking and Defending Modern Infrastructure
22mSecuring Kubernetes
01h 24mTutorial: Attacking and Defending Kube...
49mAttacking and Detecting Attacks on Kubernetes Clusters
39mKubernetes Tower Defense
30mSecuring^WAttacking Kubernetes
38mKubernetes Security: Attacking and Defending K8s Clusters
19mKeynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker