Continuous Kubernetes Security
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 11:00· Westminster - 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Explains concrete failures and fixes: require mutual TLS across the control plane (use TLS bootstrap so keys are not baked into images), lock down etcd and kubelet, and enforce least‑privilege with RBAC plus pod security policy and admission webhooks. Demonstrates tools that work: Calico for network policy, Sealed Secrets (encrypt in git, a cluster pod decrypts to a Secret), Istio/Envoy service mesh for mTLS and routing. Notes CIS benchmarks are hard to reach (100% is rare) and advocates continuous pipeline assertions and runtime checks.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 0:44About Andrew
- 1:17Why does this matter
- 1:33Everything is fine
- 2:13Cuban actors
- 2:24Agenda
- 3:18Kubernetes is insecure
- 3:46A back model
- 4:11workload security
- 4:39misconfigurations
- 4:55deployment configuration tool
- 5:21dashboard
- 6:34cluster
- 7:16security again
- 10:06bootstrap TLS nodes
- 11:00back role access control
- 12:49Legacy Authorization
- 13:14Secure Port
- 13:50Leaking Secrets
- 15:08Certificate rotation
- 16:50Pods
- 18:10Table Security Policies
- 20:26Resource linting
- 20:47Deployments
- 21:37Labels
- 23:28Containers
- 24:10Admission Controllers
- 27:07Limit Ranger
- 28:49Security Policy
- 29:51Encryption
- 30:43Sealed Secrets
- 31:50Token Requests
- 32:48Networking
- 33:31Network Policy
- 36:24Service Mesh
- 37:02Deployment Strategies
- 39:23Recap
- 40:21Multiple Clusters
- 41:32Container Runtimes
