Flying Above the Clouds: Securing Kubernetes
summary
Kubernetes control plane compromise gives full cluster control (example: exposed API led to cryptomining), so the talk emphasizes concrete defenses: enable node authorizer to limit kubelet access, use RBAC least-privilege instead of cluster-admin, enforce PodSecurityPolicies and seccomp/AppArmor to drop syscalls, and remove default shared service-account tokens. It names runtime options (gVisor, Kata Containers) and tool choices (avoid kube-spray defaults, prefer kubeadm or managed control planes), and describes Vault integration and cloud KMS for secrets rather than plaintext etcd storage.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:19What is Kubernetes? Open-source system for deploying, scaling and managing containerized apps and services
- 3:55Isolating Container Workloads, IRL
- 7:11Container Manifest & Daemon
- 7:52Spoiler: Containers Aren't Sandboxes
- 9:26Container Isolation Models Via cgroups & namespaces
- 11:33Cloud-Native Secure Architecture
- 13:11Cluster and Namespace Scopes • Resources are scoped at the Cluster or Namespace
- 14:21Control Plane & Core Components The Control Plane manages the cluster's state and schedules containers.
- 18:29Authorization Mode
- 31:18Authentication
- 34:04Fixing the Problem Always use a unique service account per pod!
- 34:50Role-Based Access Control
- 35:01Create Roles & Bindings
- 38:07Secrets Management
- 40:02Dynamic Secrets
- 41:58Conclusion Think about security early and anticipate future growth
related talks
22mSecuring Kubernetes
34mKubernetes Security 101: Best Practices to Secure Your Cluster
43mKubernetes Security: Attacking and Defending Modern Infrastructure
24mOne stop talk for kubernetes security !!
15mKeynote: Secure & Hardening Kubernetes Control Plane
35mKubernetes Security - Challenge and Opportunity?
58mTop Secret Cloud Native Security Lessons
39mThe Art of (Cloud Native) Defense: Pillars of Kubernetes Security