Cluster Wrangling: How to make Kubernetes clusters secure and usable
summary
Claim: many clusters are exposed and misconfigured — a census finds ~900,000 clusters on the internet, ~100,000 kubelets and ~5,000 etcd exposed, and 25% run unsupported Kubernetes versions. Demos show kubectl/kubeconfig or a privileged pod easily yields the CA key and cluster-admin access. Tools and fixes: use cloud IAM or OIDC (Keycloak/Dex), private clusters/authorized networks, default‑deny NetworkPolicies, automated reprovisioning via Cluster API, and admission controllers (Gatekeeper, Kyverno) to block privileged mounts and prevent privilege escalation.
AI-written summary · about
chapters (20)
- 0:00Intro
- 3:04What is Kubernetes?
- 4:25So, What is Core Kubernetes?
- 7:40Why is this important?
- 9:10Where does Usability Come in?
- 10:26Exposed Clusters
- 14:02Outdated Clusters
- 16:08Solution - Clusters As Cattle Not Pets
- 17:23Kubernetes Authentication
- 21:36Solution - Enforced External AuthN
- 22:51RBAC Complexity
- 26:37Solution - Minimal Interactive Access
- 27:46Flat Networks
- 31:54Solution - Default Deny Networks
- 33:06Breakout to underlying nod
- 38:29Solution - Admission Control
- 40:50Kubernetes and Multi-Tenan
- 44:31Solution - Kubernetes Cluster API
- 45:03A Secure Kubernetes Solution
- 47:28Conclusion
related talks
30mFortifying Kubernetes
34mKubernetes Security 101: Best Practices to Secure Your Cluster
35mInsights into Unsecured Kubernetes in the Wild
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
29mKubernetes Exposed: One Yaml Away from Disaster
37mKubernetes Security and How to Fix K8s Cluster at Scale
22mSecuring Kubernetes
31mA Hacker's Guide to Kubernetes and the Cloud