The Kubernetes Sessions Security
summary
Kubernetes architecture centers on the API server as bouncer with etcd holding manifests and the scheduler/controller manager assigning nodes; TLS termination example shows an NGINX Ingress tied to an AWS NLB and ACM certificate ARN for HTTPS at the edge. Practical controls include RBAC and kubeconfig-based auth, PodSecurity admission enforce/audit/warn modes, Calico-backed NetworkPolicies, and mTLS done via sidecar/Envoy service mesh. Tools demonstrated: kube-bench job report (runs as a Job), Trivy image scanner, OPA/Rego admission policies (blocks bad Ingress hosts), Falco as a daemonset for runtime alerts, and eBPF-based tracing to minimize container capabilities.
AI-written summary · about
chapters (11)
- 0:00Introduction to Kubernetes
- 0:42Kubernetes architecture overview
- 8:52Setting up TLS in Kubernetes
- 14:16Authentication and authorization
- 22:24Service accounts and RBAC
- 30:37Securing pods with network policies
- 35:31CIS benchmarks and kube-bench
- 39:07Container security with Trivy and Falco
- 48:00Pod security admission
- 51:59Mutual TLS for internal security
- 54:32Service mesh for mTLS
related talks
24mOne stop talk for kubernetes security !!
46mContinuous Kubernetes Security
29mKubernetes Security Best Practices
34mKubernetes Security 101: Best Practices to Secure Your Cluster
43mKubernetes Security: Attacking and Defending Modern Infrastructure
53mFlying Above the Clouds: Securing Kubernetes
38mAn Intro to Kubernetes Hardening
09mKubernetes security: a team sport