Kubernetes Security Jumpstart
summary
Kubernetes requires concrete controls not slogans: pin images to immutable digests and use image digests, run image scanners like Snyk Clair Anchore in CI, and enforce RBAC and ResourceQuotas (requests, limits, LimitRange) so noisy compromises get killed. Apply NetworkPolicy via Calico/Cilium, use seccomp/AppArmor and Falco for runtime detection, encrypt etcd, and gate deployments with an admission webhook such as OPA (example: OPA denies mismatched ingress hosts). A supposedly “strong” padlock still falls in four minutes, so layers matter.
AI-written summary · about
chapters (20)
- 0:00Introduction and welcome
- 1:06Security is a spectrum
- 5:23Kubernetes security overview
- 6:48Container security best practices
- 9:36Infrastructure security fundamentals
- 11:03Network segmentation with policies
- 12:05Runtime security with RBAC
- 14:10Resource limits and quotas
- 16:20Monitoring and logging
- 17:45Security tools introduction
- 18:28Image scanning and analysis
- 22:02Runtime security tools
- 23:46Network security tools
- 25:10Secrets management
- 25:31Image distribution security
- 26:57Security auditing tools
- 28:22Admission control with OPA
- 31:02Commercial security solutions
- 32:50Security is a continuous process
- 34:19Q&A session
related talks
33mKubernetes Security Jumpstart
28mKubernetes Security Low-Hanging Fruit
24mOne stop talk for kubernetes security !!
46mContinuous Kubernetes Security
22mSecuring Kubernetes
35mKubernetes Security - Challenge and Opportunity?
38mAn Intro to Kubernetes Hardening
34mKubernetes Security 101: Best Practices to Secure Your Cluster