How to Prevent Your Kubernetes Cluster From Being Hacked — Nico Meisenzahl and Philip Welz
summary
Shows concrete wins: switching the base image to Wolfi base image drops vulnerabilities from 798 to 0 and uses reproducible builds with mage/apko producing APK packages and SBOMs; images get Cosign keyless signing with Fulcio and Rekor (or local key mode) and gatekeeper/OPA policies block unsigned images; runtime protection uses eBPF via Tetragon to detect and kill spawned reverse shells (demo stops a Log4Shell exploit after a few milliseconds). All demos build, sign, deploy and enforce policies live.
AI-written summary · about
chapters (5)
- 0:00Introduction and overview
- 3:53Building secure images with Wolfi
- 15:53Verifying images with Cosign
- 23:08Runtime security with Tetragon
- 31:41Q&A session
related talks
22mSecuring Kubernetes
41mKubernetes Security Jumpstart
28mKubernetes Security Low-Hanging Fruit
37mSupply Chain Security in Kubernetes
35mKubernetes Security - Challenge and Opportunity?
19mKubernetes Security: Navigating the Real-World Challenges
32mHacking the Cloud Native Renaissance: Lowering Risk of Kubernetes Adoption
34mKubernetes Security 101: Best Practices to Secure Your Cluster