Container and Kubernetes security policy design: 10 critical best practices
summary
Calico positions itself as a pure Calico CNI + policy engine that supports IPtables, eBPF dataplane (removes kube-proxy, preserves source IP) and VPP/Windows HNS, claims "blazing" performance and cluster‑wide plus host‑level policies that can deny at the pod interface. It adds image scanning, runtime eBPF probes for syscall/CIS checks, a service graph with flow logs exportable to Kibana, layer‑7 WAF/DPI/IPS in Enterprise, and promises a Cloud UI deployable in about 5–10 minutes.
AI-written summary · about
chapters (7)
- 0:00Introduction to Calico
- 3:44Application modernization overview
- 8:25Securing container images
- 11:36Network segmentation in Kubernetes
- 13:03Best practices for Kubernetes security
- 14:54Monitoring Kubernetes environments
- 17:04Q&A session
related talks
52mImplementing holistic security for containers and Kubernetes
33mNavigating the Container Jungle
32mContainer and Kubernetes security policy design
32mUsing Open-Source Software to Secure Cloud-Native Applications
06mKeynote: Progress Toward Zero Trust Kubernetes Networks
44mUnderstanding Calico's eBPF data-plane
32mCalico Networking with eBPF
30mAll You Can Eat Networking. Kubernetes Goodness for the Hungriest Workloads