What We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli
summary
Kubescape scans from 10K+ unique Kubernetes clusters (about 177K scans, ~40M objects) reveal concrete failures: 91% run containers as root, widespread failures of immutable root filesystems and 81% leave default service account tokens mapped. Image scanning shows many false-positive vulnerabilities; a relevancy feature using eBPF identifies packages loaded at runtime and cuts actionable findings (Postgres example) by roughly 80%, saving triage time. CNCF graduated projects show fewer relevant vulnerabilities, while scanner misidentifications remain a notable issue.
AI-written summary · about
chapters (12)
- 0:00Introduction to Kubernetes security
- 3:10About Cube Escape and Armo
- 5:39Research methodology overview
- 7:47Compliance frameworks comparison
- 9:13Top misconfiguration controls
- 13:48General vs CNCF project gaps
- 14:08Image vulnerabilities overview
- 15:31Most common vulnerabilities
- 18:45Vulnerability relevancy explained
- 22:23CNCF project security analysis
- 23:28Security posture improvement tips
- 24:14Q&A session
related talks
51mWhat We've Learned From Scanning 10K+ Kubernetes Clusters
23mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
18mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
10mLightning Talk: What Have We Learned from Scanning Over 10K Unique Clusters with Ku...
35mUnpacking Open Source Security in Public Repos & Registries
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
19mKubernetes Security: Navigating the Real-World Challenges
34mUnpacking Open Source Security in Public Repos & Registries