What We've Learned From Scanning 10K+ Kubernetes Clusters
summary
Scans of roughly 17,000 clusters and 40M Kubernetes objects feed the open source Cubescape scanner and Armo platform and reveal concrete, repeatable problems: about 91% run as root in the general sample (84% in CNCF graduates), immutable root filesystems are absent in ~97% of images, and 14 controls reoccur across most clusters. Image scanners flag many CVEs but only a few are actually reachable at runtime; an eBPF-based sniffer proves much more accurate.
AI-written summary · about
chapters (9)
- 0:00Start
- 7:33Protecting Kubernetes - two main paradigms to apply
- 8:52Kubescape Is Becoming The Most Popular K8s Security Open-Source tool on Github
- 16:47Configuration scans
- 23:01Most failed in general population
- 28:54credentials_everywhere
- 36:21Container image scans
- 38:52TOP vulnerabilities in general population
- 48:09Closing thoughts
related talks
30mWhat We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli
23mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
18mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
35mUnpacking Open Source Security in Public Repos & Registries
10mLightning Talk: What Have We Learned from Scanning Over 10K Unique Clusters with Ku...
34mUnpacking Open Source Security in Public Repos & Registries
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
16mUnpacking Open Source Security in Public Repos