Hardening automation with Kubespray - A journey into the open-source security world
summary
Uses Kubespray plus kubeadm to automate CIS hardening and land concrete patches: adds CIS 1.9 support, implements a configurable event rate limit admission plugin for API DoS protection, exposes kubelet’s streaming connection idle timeout so default 4‑hour sessions can be shortened, splits kube_feature_gates per component, enables seccomp RuntimeDefault, and hardens kubelet’s systemd unit with IP allow/deny via eBPF (requires cgroup v2); changes are merged into Kubespray and come with a community hardening guide.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:14About Classis and use case
- 3:01Security guidelines and support challenges
- 4:27Why Kubespray for hardening
- 7:17CIS benchmark contributions
- 9:01Event rate limit plugin
- 10:47Streaming connection timeout
- 11:52Feature gates and admission plugins
- 13:18Seccomp default admission plugin
- 15:24Kubelet systemd service hardening
- 18:15Q&A
related talks
38mAn Intro to Kubernetes Hardening
36mKubespray Intro
44mSIG Cluster Lifecycle: What's New in Kubespray
26mMulti-layer hardening in Kubernetes
32mDeep Dive: Kubespray (a sig-cluster-lifecycle's project)
34mDeep Dive: Kubernetes/Kubespray (Cluster Lifecycle) SIG
22mSecuring Kubernetes
02h 42mSecuring Your On-Premise Kubernetes Cluster from Scratch