Securing Kubernetes
summary
Outlines attacker paths (network, control plane, service account, compromised image) and maps concrete defenses: make the API private, use SSH key auth and firewalls, avoid clusterrolebinding and enforce namespace-scoped RBAC, enable audit logging and run CIS benchmarks, encrypt etcd at rest and mount secrets as files from Vault/AWS/Azure/Google instead of env vars. Recommends CIS-hardened node images, image scanning with Clair, admission policies with Open Policy Agent/Kyverno (validating/mutating webhooks), drop capabilities/seccomp/AppArmor, use gVisor/Firecracker and runtime monitors like Falco. Notes ~70% of risk lives in the control plane so keep clusters patched.
AI-written summary · about
chapters (14)
- 0:00Kubernetes security intro
- 1:05Attacker gains network access
- 2:10Kubernetes RBAC explained
- 3:58Role bindings and cluster roles
- 5:46Hardening with audit logs
- 6:49CIS benchmarks for security
- 7:33Encrypting etcd and secrets
- 8:37Network policies to isolate services
- 11:28Securing the code pipeline
- 13:56Admission controllers
- 16:03Container hardening best practices
- 17:48Runtime security and sandboxing
- 19:37Managing secrets securely
- 20:20Final thoughts on security
related talks
34mKubernetes Security 101: Best Practices to Secure Your Cluster
53mFlying Above the Clouds: Securing Kubernetes
20mDefense in Depth: Securing your new Kubernetes cluster from the challenges that lurk within
35mKubernetes Security - Challenge and Opportunity?
46mContinuous Kubernetes Security
43mKubernetes Security: Attacking and Defending Modern Infrastructure
11mSecuring the Kubernetes Ecosystem
19mHow to Secure Your Kubernetes Clusters