A secure journey on Kubernetes
summary
Covers concrete tooling and failures: runs the kube-bench CIS checks and shows a job blocked by PodSecurityPolicy/PSP defaults, scans images with Clair + Harbor and finds 62 vulnerabilities (4 fixable) in an upstream image, deploys Falco kernel rules to detect in-container cryptomining, and enforces image provenance with OPA/Gatekeeper where a constraint denies Docker Hub images in production but allows images from the private registry. Demonstrations include logs, remediation hints, and automated registry gating.
AI-written summary · about
chapters (14)
- 0:00Kubernetes security journey
- 1:56Security modes and tools
- 5:14Securing infrastructure
- 7:46CIS benchmark and kube-bench
- 9:12Role-based access control
- 10:19Security policies and auditing
- 11:45Vulnerability detection with Clair
- 13:58Testing cluster and app security
- 16:10Runtime security with Falco
- 19:24Policy enforcement with OPA
- 20:50Demo: kube-bench compliance
- 24:26Demo: Scanning images with Clair
- 25:09Demo: Policy enforcement with Gatekeeper
- 29:10Summary and Q&A
related talks
02h 42mSecuring Your On-Premise Kubernetes Cluster from Scratch
22mSecuring Kubernetes
46mA Security State of Mind: Continuous Security with Kubernetes
38mAn Intro to Kubernetes Hardening
19mKubernetes Security: Navigating the Real-World Challenges
38mTutorial: Building Security into Kubernetes Deployment Pipelines
33mKubernetes Security Jumpstart
43mKubernetes Security: Attacking and Defending Modern Infrastructure