Safeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
summary
Compares three concrete controls and shows a working deployment: Pod Security Admission at level Restricted enforces cluster-level baseline constraints, NeuVector protect mode with CVE checks and runtime/network enforcement provides image scanning, monitor/protect modes and policy reports, and Kyverno mutating and validating policies auto-insert securityContext and block disallowed changes. A combined setup routes admission through mutation then validation, produces policy reports per namespace, and enforces restrictions while allowing remediation workflows.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:09Admission controllers overview
- 5:11Security admission controllers levels
- 8:00Container security context
- 11:19NeuVector runtime security
- 16:30NeuVector policy violations
- 20:14Combining solutions
- 24:47Implementation strategy
- 27:43Summary and future
- 28:07Q&A
related talks
42mBehold: A New Way to Deploy Pod Security Policies Using Kyverno!
34mShift Left and Security-as-Code: Security on Kubernetes
24mOne stop talk for kubernetes security !!
22mSecuring Kubernetes
41mKubernetes Security Jumpstart
37mKyverno Introduction And Overview
49mKubernetes Policy as Code with Kyverno
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat